Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks

Backend:
- Widget total: 0 bug fixed (now returns len(widgets))
- Widget update/delete: now verifies workspace_id + tenant_id (was only tenant_id)
- Workspace context: returns all modules with is_visible flag (was only visible modules)
- is_workspace_manager() removed (Plan 4.2: no manager checks)
- seed_default_workspace: removed hardcoded modules (Plan 4.7: no hardcoded tiles)
- Workspace permissions registered in CORE_PERMISSIONS (Plan 2.3)

Frontend:
- Permission fallback removed: Sidebar/TopBar show nothing while loading (Plan 2.4)
- workspaceStore isModuleVisible: fail-closed when isSystemAdmin undefined
- WorkspaceManager: AVAILABLE_MODULES replaced with dynamic core+plugin items (Plan 4.4)

Tests:
- 17 backend tests (removed is_workspace_manager test, adapted widget/context tests)
- 13 frontend tests (added undefined-isSystemAdmin test, adapted visibility tests)

app/routes/workspaces.py

@@ -284,7 +284,8 @@ async def list_widgets(
         wid = uuid.UUID(workspace_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid workspace_id", "code": "invalid_id"})
-    return {"items": await workspace_service.get_widgets(db, tenant_id, wid), "total": 0}
+    widgets = await workspace_service.get_widgets(db, tenant_id, wid)
+    return {"items": widgets, "total": len(widgets)}
 
 
 @router.post("/{workspace_id}/widgets", status_code=status.HTTP_201_CREATED)
@@ -317,11 +318,12 @@ async def update_widget(
     """Update a widget."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     try:
+        ws_id = uuid.UUID(workspace_id)
         wid = uuid.UUID(widget_id)
     except ValueError:
-        raise HTTPException(400, detail={"detail": "Invalid widget_id", "code": "invalid_id"})
+        raise HTTPException(400, detail={"detail": "Invalid ID", "code": "invalid_id"})
     result = await workspace_service.update_widget(
-        db, tenant_id, wid,
+        db, tenant_id, ws_id, wid,
         body.position_x, body.position_y, body.width, body.height, body.config,
     )
     if result is None:
@@ -339,10 +341,11 @@ async def delete_widget(
     """Delete a widget."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     try:
+        ws_id = uuid.UUID(workspace_id)
         wid = uuid.UUID(widget_id)
     except ValueError:
-        raise HTTPException(400, detail={"detail": "Invalid widget_id", "code": "invalid_id"})
-    deleted = await workspace_service.delete_widget(db, tenant_id, wid)
+        raise HTTPException(400, detail={"detail": "Invalid ID", "code": "invalid_id"})
+    deleted = await workspace_service.delete_widget(db, tenant_id, ws_id, wid)
     if not deleted:
         raise HTTPException(404, detail={"detail": "Widget not found", "code": "not_found"})