feat(apps): add Phase 4 resource participation

[Maneek21]

Summary

• add the closed, tenant-bound ResourceRef authorization seam with code-owned Module and Task adapters
• add additive resource relation storage, strict Module v2 resource fields, authenticated relation routes, and a generic connected-resource picker
• reauthorize Module search, knowledge retrieval, MCP, and agent citations immediately before return
• prove two independently packaged Apps compose through Contacts and Campaigns without copied data or execution authority
• preserve Module v1 manifests, digests, same-installation relations, and App data across disable/re-enable

Validation

• shared contracts: 62 passed
• public App Kit: 8 passed
• database upgrade/schema guards: 24 passed
• web Module suite: 30 passed
• focused authorization, provider, architecture, import, connector, and trust tests passed
• six live PostgreSQL Phase 4 journeys passed against an explicit disposable database
• broader search, knowledge, MCP context, and privacy caller tests passed
• repository-wide typecheck passed
• production build passed, including the Next.js production build
• Contacts and Campaigns each produced the same package digest twice with connected permissions: none
• desktop 1440x1000 and mobile 390x844 rendered interaction checks passed with no browser console errors

Boundaries

This remains additive infrastructure. Apps receive no execution authority, capability requirements, grants, connector bindings, token scopes, runtime, automation, custom UI, public ingress, or network effects. The sandbox email provider remains unused.

The local candidate is certified, but Phase 4 is not claimed as an immutable release yet. Fresh pgvector schema, supported release-image upgrade, backup/restore continuity, predecessor-image rollback, and candidate image digest remain the release-host gate after merge.