feat(modules): add external module system with auto-discovery and public pages support

- add `src/core/modules/` with registry, discovery (server), and public index
- add `src/core/public-pages/` with registry, server component, and public index
- add `src/core/users/permissions-registry.js` for runtime permission registration
- expose `./modules`, `./public-pages`, and `./public-pages/server` package exports
- rename `registerFeatureRoutes` to `registerApiRoutes` with backward-compatible alias
- extend `seedDefaultRolesAndPermissions` to include module-registered permissions
- update `initializeZen` and shared init to wire module discovery and registration
- add `docs/MODULES.md` documenting the `@zen/module-*` authoring contract
- update `docs/DEV.md` with references to module system docs

src/shared/lib/init.js

@@ -19,7 +19,11 @@ import { registerStoragePolicies, clearStorageConfig } from '@zen/core/storage';
 import { validateSession } from '../../features/auth/session.js';
 import { routes as authRoutes } from '../../features/auth/api.js';
 import { storageAccessPolicies } from '../../features/auth/storage-policies.js';
-import { done, warn } from './logger.js';
+import { PERMISSION_DEFINITIONS } from '../../core/users/constants.js';
+import { registerPermissions, clearRegisteredPermissions } from '../../core/users/permissions-registry.js';
+import { discoverModules, validateModuleEnvVars } from '../../core/modules/discover.server.js';
+import { getRegisteredModules, clearRegisteredModules } from '../../core/modules/registry.js';
+import { done, warn, fail } from './logger.js';
 
 const ZEN_INIT_KEY = Symbol.for('__ZEN_INITIALIZED__');
 
@@ -38,6 +42,22 @@ export async function initializeZen() {
   configureRouter({ resolveSession: validateSession });
   registerFeatureRoutes(authRoutes);
   registerStoragePolicies(storageAccessPolicies);
+  registerPermissions(PERMISSION_DEFINITIONS);
+
+  // Découverte et activation des modules @zen/module-*
+  await discoverModules();
+  const modules = getRegisteredModules();
+  validateModuleEnvVars(modules);
+  for (const mod of modules) {
+    if (Array.isArray(mod.manifest?.permissions)) {
+      registerPermissions(mod.manifest.permissions);
+    }
+    try {
+      await mod.register();
+    } catch (error) {
+      fail(`zen-modules: ${mod.manifest.name} register() threw — ${error.message}`);
+    }
+  }
 
   done('ZEN: ready');
 
@@ -49,5 +69,7 @@ export function resetZenInitialization() {
   clearRouterConfig();
   clearFeatureRoutes();
   clearStorageConfig();
+  clearRegisteredPermissions();
+  clearRegisteredModules();
   warn('ZEN: initialization reset');
 }