feat(v1.1.3-modules): shared types, migrations, engine + resolver scaffold

Lays down the v1.1.3 plumbing:

- `ScriptKind` enum in `picloud-shared` ('endpoint' | 'module').
- `ModuleSource` trait + `ModuleScript` DTO + `NoopModuleSource` in
  `picloud-shared`. Resolver lives in `executor-core`; Postgres impl
  in `manager-core` (`PostgresModuleSource`).
- `Services::new` grows a fifth `modules: Arc<dyn ModuleSource>` arg.
- `ScriptValidator` returns `ValidatedScript { imports }` so the
  manager can populate the dep-graph table on save. New
  `validate_module` method on the trait gates module-shape rules.
- `Engine::execute_ast(&Arc<rhai::AST>, req)` lets the orchestrator's
  script cache reuse compiled ASTs. `Engine::execute(&str, req)` is
  preserved as a convenience that compiles inline. `Engine::compile`
  exposes the AST for callers that want to cache.
- `PicloudModuleResolver` replaces `DummyModuleResolver` per-call.
  Bridges Rhai's sync `ModuleResolver::resolve` to async
  `ModuleSource::lookup` via `Handle::block_on`. Enforces:
  - cross-app isolation (resolver captures `Arc<SdkCallCx>`),
  - circular import detection (in-progress stack on the resolver),
  - import depth limit (default 8 via
    `Limits::module_import_depth_max`).
- Module-shape validation walks `ast.statements()` via `rhai/internals`
  and accepts only `Var { CONSTANT }`, `Import`, and `Noop`. The
  manager admin endpoint runs `validate_module` at save (primary
  gate); resolver re-runs it at load (defense in depth).
- LRU cache `(AppId, name) -> (updated_at, Arc<Module>)` owned by
  `Engine`. Size from `PICLOUD_MODULE_CACHE_SIZE` (default 512).
- Migration `0015_scripts_kind.sql` adds `scripts.kind` + composite
  index + module-name shape CHECK.
- Migration `0016_script_imports.sql` adds the dep-graph table with
  FK CASCADE on both columns.
- Repo: `kind` threaded through SELECT/INSERT/UPDATE. New
  `count_routes_for_script` / `count_triggers_for_script` /
  `list_imports` methods. `create`/`update` open a transaction and
  call `replace_imports_tx` to populate the dep-graph.
- Admin endpoint: accepts `kind`; rejects reserved module names;
  rejects `endpoint → module` transitions when routes / triggers
  exist.
- SDK_VERSION 1.3 → 1.4.

Workspace builds; full test suite (~440 tests) green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/validator.rs

@@ -10,8 +10,39 @@ use thiserror::Error;
 pub enum ValidationError {
     #[error("invalid script source: {0}")]
     Syntax(String),
+
+    /// v1.1.3: source compiled but failed the module-shape gate
+    /// (top-level statements other than `fn` / `const` / `import`).
+    #[error("module syntax error: {0}")]
+    ModuleShape(String),
+}
+
+/// Output of a successful validate. v1.1.3 carries the list of literal
+/// `import "<name>"` paths the script declares — the manager writes
+/// these into the `script_imports` dep-graph table. Endpoints may also
+/// have imports; the field is populated unconditionally.
+#[derive(Debug, Clone, Default)]
+pub struct ValidatedScript {
+    /// Literal-path imports (in declaration order). Dynamic imports
+    /// `import some_var as y;` are not captured — the resolver still
+    /// honors them at runtime, but the dep graph only tracks names
+    /// known at compile time.
+    pub imports: Vec<String>,
 }
 
 pub trait ScriptValidator: Send + Sync {
-    fn validate(&self, source: &str) -> Result<(), ValidationError>;
+    /// Endpoint-shape validation: parse-only syntax check. Returns the
+    /// declared (literal) imports so the manager can populate the
+    /// dep-graph table on save.
+    fn validate(&self, source: &str) -> Result<ValidatedScript, ValidationError>;
+
+    /// Module-shape validation: parse + reject any top-level
+    /// statement that isn't `fn` / `const` / `import`. Default impl
+    /// rejects every module so non-engine validators stay simple
+    /// (tests / stubs don't need to know module rules).
+    fn validate_module(&self, _source: &str) -> Result<ValidatedScript, ValidationError> {
+        Err(ValidationError::ModuleShape(
+            "module validation not implemented by this validator".into(),
+        ))
+    }
 }