fix(modules): eliminate core module dependency cycles and add DAG validation #680

Parent epic: #679

Evidence

The registered descriptors currently form a cycle:

• tenant_admin -> profile_identity, identity_access
• profile_identity -> tenant_admin
• identity_access -> tenant_admin, profile_identity

The lifecycle engine in src/modules/module-management/domain/tenant-module-lifecycle.ts rejects dependency cycles, so registry metadata and lifecycle behavior disagree.

Objective

Make core module dependencies a valid directed acyclic graph and fail CI when any registered descriptor introduces a missing dependency, self-dependency, or cycle.

Scope

• Reassign core prerequisites to the narrowest valid DAG. Starting proposal:
  • tenant_admin: []
  • profile_identity: [tenant_admin]
  • identity_access: [tenant_admin, profile_identity]
• Move cross-module initial setup orchestration into a platform_bootstrap application service or equivalent composition-root concern.
• Add a registry-wide deterministic DAG validator with actionable cycle paths.
• Reuse the validator in module lifecycle commands, tests, and CI.
• Document dependency direction and bootstrap ownership.

Out of scope

• Dynamic third-party module installation.
• Public module marketplace.
• Changing tenant authorization semantics.

Acceptance criteria

• All 14 registered module descriptors form a valid DAG.
• Validator rejects missing keys, self-dependencies, duplicate dependencies, and indirect cycles.
• Error output contains the offending dependency path without secrets.
• Bootstrap/setup behavior remains idempotent.
• Unit tests cover valid graph, direct cycle, indirect cycle, and missing node.
• bun run check invokes the graph gate and passes.
• Architecture/module-management docs are updated.