Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks

Backend:
- Widget total: 0 bug fixed (now returns len(widgets))
- Widget update/delete: now verifies workspace_id + tenant_id (was only tenant_id)
- Workspace context: returns all modules with is_visible flag (was only visible modules)
- is_workspace_manager() removed (Plan 4.2: no manager checks)
- seed_default_workspace: removed hardcoded modules (Plan 4.7: no hardcoded tiles)
- Workspace permissions registered in CORE_PERMISSIONS (Plan 2.3)

Frontend:
- Permission fallback removed: Sidebar/TopBar show nothing while loading (Plan 2.4)
- workspaceStore isModuleVisible: fail-closed when isSystemAdmin undefined
- WorkspaceManager: AVAILABLE_MODULES replaced with dynamic core+plugin items (Plan 4.4)

Tests:
- 17 backend tests (removed is_workspace_manager test, adapted widget/context tests)
- 13 frontend tests (added undefined-isSystemAdmin test, adapted visibility tests)

frontend/src/store/__tests__/workspaceStore.test.ts

@@ -57,7 +57,11 @@ describe('workspaceStore', () => {
   });
 
   it('isModuleVisible returns true when no workspace context (backward compatible)', () => {
-    expect(useWorkspaceStore.getState().isModuleVisible('contacts')).toBe(true);
+    expect(useWorkspaceStore.getState().isModuleVisible('contacts', false)).toBe(true);
+  });
+
+  it('isModuleVisible returns false when isSystemAdmin is undefined (loading)', () => {
+    expect(useWorkspaceStore.getState().isModuleVisible('contacts', undefined)).toBe(false);
   });
 
   it('isModuleVisible returns true for system admin', () => {
@@ -75,7 +79,7 @@ describe('workspaceStore', () => {
       modules: [{ module_key: 'contacts', menu_order: 0, config: {} }],
       widgets: [],
     });
-    expect(useWorkspaceStore.getState().isModuleVisible('mail')).toBe(false);
+    expect(useWorkspaceStore.getState().isModuleVisible('mail', false)).toBe(false);
   });
 
   it('isModuleVisible returns true for module in workspace', () => {
@@ -87,8 +91,8 @@ describe('workspaceStore', () => {
       ],
       widgets: [],
     });
-    expect(useWorkspaceStore.getState().isModuleVisible('contacts')).toBe(true);
-    expect(useWorkspaceStore.getState().isModuleVisible('calendar')).toBe(true);
+    expect(useWorkspaceStore.getState().isModuleVisible('contacts', false)).toBe(true);
+    expect(useWorkspaceStore.getState().isModuleVisible('calendar', false)).toBe(true);
   });
 
   it('visibleModuleKeys returns set of visible module keys', () => {

frontend/src/store/workspaceStore.ts

@@ -92,6 +92,8 @@ export const useWorkspaceStore = create<WorkspaceStoreState>()(
       isModuleVisible: (moduleKey: string, isSystemAdmin?: boolean) => {
         // System admins see all modules regardless of workspace
         if (isSystemAdmin) return true;
+        // While permissions are loading, show nothing (fail-closed)
+        if (isSystemAdmin === undefined) return false;
         // If no workspace context, show all (backward compatible)
         const ctx = get().context;
         if (!ctx?.workspace_id || !ctx?.modules?.length) return true;