Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks

Backend:
- Widget total: 0 bug fixed (now returns len(widgets))
- Widget update/delete: now verifies workspace_id + tenant_id (was only tenant_id)
- Workspace context: returns all modules with is_visible flag (was only visible modules)
- is_workspace_manager() removed (Plan 4.2: no manager checks)
- seed_default_workspace: removed hardcoded modules (Plan 4.7: no hardcoded tiles)
- Workspace permissions registered in CORE_PERMISSIONS (Plan 2.3)

Frontend:
- Permission fallback removed: Sidebar/TopBar show nothing while loading (Plan 2.4)
- workspaceStore isModuleVisible: fail-closed when isSystemAdmin undefined
- WorkspaceManager: AVAILABLE_MODULES replaced with dynamic core+plugin items (Plan 4.4)

Tests:
- 17 backend tests (removed is_workspace_manager test, adapted widget/context tests)
- 13 frontend tests (added undefined-isSystemAdmin test, adapted visibility tests)

frontend/src/components/layout/Sidebar.tsx

@@ -70,8 +70,8 @@ export function Sidebar() {
   // Use hasPermission directly — permissions are loaded via useUserPermissions hook
   const canAccess = (perm?: string): boolean => {
     if (!perm) return true;
-    // While permissions are loading (undefined), show everything; backend 403 catches errors
-    if (!user?.permissions && user?.is_system_admin === undefined) return true;
+    // While permissions are loading (undefined), show nothing for protected items
+    if (!user?.permissions && user?.is_system_admin === undefined) return false;
     return hasPermission(perm);
   };
 

frontend/src/components/layout/TopBar.tsx

@@ -25,7 +25,7 @@ export function TopBar() {
   const { hasPermission } = usePermission();
   // While permissions are loading (undefined), show everything; backend 403 catches errors
   const canAccess = (perm: string): boolean => {
-    if (!user?.permissions && user?.is_system_admin === undefined) return true;
+    if (!user?.permissions && user?.is_system_admin === undefined) return false;
     return hasPermission(perm);
   };
   const restoreWindow = useWindowStore((s) => s.restoreWindow);