feat(modules): company-context module surfaces and schema-driven settings

Adds the read-only company "Active Modules" index page (lists every
instance-activated module with a Settings shortcut) and the schema-driven
settings framework (generic BaseSchemaForm.vue renderer + per-company
persistence in CompanySetting). Bundled because they share the same
routes/api.php edit and the index page's Settings button targets the
settings page.

Backend:

- CompanyModulesController::index() returns every Module::enabled = true row
  with a kebab-case slug (via Str::kebab()) and a has_settings flag computed
  from \InvoiceShelf\Modules\Registry::settingsFor(). nwidart stores module
  names in PascalCase ("HelloWorld") but URLs and registry keys use kebab
  ("hello-world") — the controller normalizes so module authors can call
  Registry::registerSettings('hello-world') naturally without thinking
  about the storage format.

- ModuleSettingsController::show(\$slug) returns the registered Schema +
  per-company values from CompanySetting (defaults flow through when nothing
  has been saved yet). update(\$slug) builds Laravel validator rules from
  the Schema's per-field rules arrays — with type-rule fallbacks for
  switch -> boolean, number -> numeric, multiselect -> array — silently
  drops unknown keys, and persists via CompanySetting::setSettings() under
  the module.{slug}.{key} prefix. Activation is instance-global, but
  settings are per-company: two companies on the same instance can
  configure the same activated module differently.

- routes/api.php mounts GET /api/v1/company-modules at the root of the
  company API group and GET/PUT /api/v1/modules/{slug}/settings inside the
  existing modules prefix.

Frontend:

- BaseSchemaForm.vue is the central new component — a generic schema-driven
  form renderer that maps schema fields to BaseInput / BaseTextarea /
  BaseSwitch / BaseMultiselect by type, and builds Vuelidate rules
  dynamically from each field's rules array (supports required, email, url,
  numeric, min:N, max:N). New fields are added by extending the type ->
  component map.

- CompanyModulesIndexView.vue fetches /company-modules and renders a card
  grid (with empty/loading states); CompanyModuleCard.vue is the per-row
  component with the Settings button. ModuleSettingsView.vue fetches
  /modules/{slug}/settings, hands {schema, values} to BaseSchemaForm, and
  posts back on submit.

- Company-context routes.ts is rebuilt after the previous commit relocated
  the marketplace browser away. It now declares modules.index +
  modules.settings, both gated by manage-module ability.

- New api/services/{companyModules,moduleSettings}.service.ts thin clients.

- lang/en.json adds modules.index.{description,empty_title,empty_description},
  modules.settings.{title,open,saved,not_found,none}, and
  modules.sidebar.section_title. The sidebar key is added here even though
  the dynamic sidebar rendering lands in the next commit — keeping all i18n
  additions in one file edit avoids hunk-splitting lang/en.json.

app/Http/Controllers/Company/Modules/CompanyModulesController.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Controllers\Company\Modules;
+
+use App\Http\Controllers\Controller;
+use App\Models\Module;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Str;
+use InvoiceShelf\Modules\Registry as ModuleRegistry;
+
+/**
+ * Read-only company-context Active Modules index.
+ *
+ * Lists every module the super admin has activated on this instance
+ * (Module::enabled = true) and reports whether each one has registered a
+ * settings schema. The frontend uses this to render the company-context
+ * "Modules" landing page with a Settings button per active module.
+ *
+ * Activation is instance-global; per-company customization happens through
+ * settings (per CompanySetting under the module.{slug}.* prefix).
+ *
+ * Slug convention: nwidart stores the module's PascalCase class name in
+ * `modules.name` (e.g. "HelloWorld"), but URLs and registry keys use the
+ * kebab-case form ("hello-world") for readability. We normalize via
+ * Str::kebab() so module authors can call Registry::registerMenu('hello-world')
+ * naturally without thinking about the storage format.
+ */
+class CompanyModulesController extends Controller
+{
+    public function index(): JsonResponse
+    {
+        $this->authorize('manage modules');
+
+        $modules = Module::query()
+            ->where('enabled', true)
+            ->get()
+            ->map(function (Module $module) {
+                $slug = Str::kebab($module->name);
+
+                return [
+                    'slug' => $slug,
+                    'name' => $module->name,
+                    'version' => $module->version,
+                    'has_settings' => ModuleRegistry::settingsFor($slug) !== null,
+                    'menu' => ModuleRegistry::menuFor($slug),
+                ];
+            })
+            ->values();
+
+        return response()->json(['data' => $modules]);
+    }
+}

app/Http/Controllers/Company/Modules/ModuleSettingsController.php

@@ -0,0 +1,151 @@
+<?php
+
+namespace App\Http\Controllers\Company\Modules;
+
+use App\Http\Controllers\Controller;
+use App\Models\CompanySetting;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use InvoiceShelf\Modules\Registry as ModuleRegistry;
+use InvoiceShelf\Modules\Settings\Schema;
+
+/**
+ * Schema-driven module settings backend.
+ *
+ * Each active module's ServiceProvider::boot() calls
+ * Registry::registerSettings($slug, $schema) once at app boot. This controller
+ * exposes that schema to the frontend, validates submitted values against the
+ * schema's per-field rules, and persists per-company values into CompanySetting
+ * under the key prefix `module.{slug}.{field_key}`.
+ *
+ * Activation is instance-global, but settings are per-company — two companies
+ * on the same instance can configure the same activated module differently.
+ */
+class ModuleSettingsController extends Controller
+{
+    public function show(Request $request, string $slug): JsonResponse
+    {
+        $this->authorize('manage modules');
+
+        $schema = ModuleRegistry::settingsFor($slug);
+
+        if ($schema === null) {
+            abort(404, "Module '{$slug}' has not registered a settings schema.");
+        }
+
+        $values = collect($schema->fields())
+            ->mapWithKeys(fn (array $field) => [
+                $field['key'] => CompanySetting::getSetting(
+                    "module.{$slug}.{$field['key']}",
+                    $request->header('company')
+                ) ?? $field['default'],
+            ])
+            ->all();
+
+        return response()->json([
+            'schema' => $schema->toArray(),
+            'values' => $values,
+        ]);
+    }
+
+    public function update(Request $request, string $slug): JsonResponse
+    {
+        $this->authorize('manage modules');
+
+        $schema = ModuleRegistry::settingsFor($slug);
+
+        if ($schema === null) {
+            abort(404, "Module '{$slug}' has not registered a settings schema.");
+        }
+
+        $rules = $this->buildRules($schema);
+        $allowedKeys = array_keys($rules);
+
+        $validated = $request->validate($rules);
+
+        $companyId = $request->header('company');
+
+        // Only persist keys the schema knows about — silently drop unknown keys
+        // rather than letting modules write arbitrary settings.
+        $settingsToWrite = [];
+        foreach ($allowedKeys as $key) {
+            if (array_key_exists($key, $validated)) {
+                $settingsToWrite["module.{$slug}.{$key}"] = $this->normalizeForStorage($validated[$key]);
+            }
+        }
+
+        if ($settingsToWrite !== []) {
+            CompanySetting::setSettings($settingsToWrite, $companyId);
+        }
+
+        return response()->json(['success' => true]);
+    }
+
+    /**
+     * Convert a Schema's field rule arrays into a flat Laravel validator rules array.
+     *
+     * Field rules are passed through verbatim — a field declared as
+     * `'rules' => ['required', 'string', 'max:255']` becomes
+     * `['my_field' => ['required', 'string', 'max:255']]`. The frontend's
+     * BaseSchemaForm.vue understands a subset of these for client-side validation;
+     * the backend validator is the source of truth.
+     *
+     * @return array<string, array<int, string>>
+     */
+    private function buildRules(Schema $schema): array
+    {
+        $rules = [];
+
+        foreach ($schema->fields() as $field) {
+            $rules[$field['key']] = $this->withTypeRule($field);
+        }
+
+        return $rules;
+    }
+
+    /**
+     * Prepend a sensible per-type validation rule so booleans must be booleans,
+     * numbers must be numeric, etc., even if the module didn't declare it.
+     *
+     * @param  array<string, mixed>  $field
+     * @return array<int, string>
+     */
+    private function withTypeRule(array $field): array
+    {
+        /** @var array<int, string> $declared */
+        $declared = $field['rules'] ?? [];
+
+        $typeRule = match ($field['type']) {
+            'switch' => 'boolean',
+            'number' => 'numeric',
+            'multiselect' => 'array',
+            default => 'nullable',
+        };
+
+        // Avoid duplicating the type rule if the module already declared it
+        if (in_array($typeRule, $declared, true)) {
+            return $declared;
+        }
+
+        return array_merge([$typeRule], $declared);
+    }
+
+    /**
+     * CompanySetting stores everything as strings. Cast booleans, ints, and
+     * arrays to a representation that round-trips through getSetting/setSetting
+     * without losing information. Reads happen in show() above and naturally
+     * return strings; the frontend handles re-coercion in BaseSchemaForm.vue.
+     */
+    private function normalizeForStorage(mixed $value): string
+    {
+        if (is_bool($value)) {
+            return $value ? '1' : '0';
+        }
+
+        if (is_array($value)) {
+            return json_encode($value, JSON_UNESCAPED_SLASHES) ?: '[]';
+        }
+
+        return (string) ($value ?? '');
+    }
+}