Reparaturplan Fixes: Widget workspace_id check, total bug, context is_visible, permissions, fallbacks

Backend:
- Widget total: 0 bug fixed (now returns len(widgets))
- Widget update/delete: now verifies workspace_id + tenant_id (was only tenant_id)
- Workspace context: returns all modules with is_visible flag (was only visible modules)
- is_workspace_manager() removed (Plan 4.2: no manager checks)
- seed_default_workspace: removed hardcoded modules (Plan 4.7: no hardcoded tiles)
- Workspace permissions registered in CORE_PERMISSIONS (Plan 2.3)

Frontend:
- Permission fallback removed: Sidebar/TopBar show nothing while loading (Plan 2.4)
- workspaceStore isModuleVisible: fail-closed when isSystemAdmin undefined
- WorkspaceManager: AVAILABLE_MODULES replaced with dynamic core+plugin items (Plan 4.4)

Tests:
- 17 backend tests (removed is_workspace_manager test, adapted widget/context tests)
- 13 frontend tests (added undefined-isSystemAdmin test, adapted visibility tests)

frontend/src/store/workspaceStore.ts

@@ -92,6 +92,8 @@ export const useWorkspaceStore = create<WorkspaceStoreState>()(
       isModuleVisible: (moduleKey: string, isSystemAdmin?: boolean) => {
         // System admins see all modules regardless of workspace
         if (isSystemAdmin) return true;
+        // While permissions are loading, show nothing (fail-closed)
+        if (isSystemAdmin === undefined) return false;
         // If no workspace context, show all (backward compatible)
         const ctx = get().context;
         if (!ctx?.workspace_id || !ctx?.modules?.length) return true;