feat(modules): v1 feature-module gating + Investments

Exploration spike following expert-panel synthesis. Codifies the 3-tier
gating model (instance / per-user / per-family) without adding a
framework. Investments is the first family-scoped module.

- Family#disabled_modules: string[] column, opt-out semantics. No
  per-module DB column. Existing families default to [] = enabled.
- Family::AVAILABLE_MODULES = %w[investments] (the registry).
- ModuleGateable concern (auto-included in ApplicationController):
  require_module! class macro + module_enabled? helper.
- Api::V1::BaseController#require_module!: 403 feature_disabled JSON,
  mirrors require_ai_enabled.
- NavigationHelper extracts mobile/desktop nav into a single source
  with module: key support; mobile shrinks via justify-around, never
  auto-fills empty slots.
- Settings → Preferences gains a family-scoped module toggle card.
- 4 HTML controllers (Investments, Holdings, Trades, Securities) +
  3 API controllers gated. Investment/Crypto account types hidden in
  the new-account modal when off.
- docs/feature-gating.md codifies the rule for future modules.

Background-job layer not wired (no Investments-specific scheduled job
to gate; flagged as TODO in docs). Run db:migrate before bin/rails
test. No PR yet — awaiting decisions in open-questions list.

app/controllers/concerns/module_gateable.rb

@@ -0,0 +1,25 @@
+module ModuleGateable
+  extend ActiveSupport::Concern
+
+  included do
+    helper_method :module_enabled?
+  end
+
+  class_methods do
+    def require_module!(name)
+      before_action -> { enforce_module!(name) }
+    end
+  end
+
+  def module_enabled?(name)
+    family = Current.family
+    return true if family.nil?
+    family.module_enabled?(name)
+  end
+
+  private
+    def enforce_module!(name)
+      return if module_enabled?(name)
+      redirect_to root_path, alert: I18n.t("modules.not_enabled")
+    end
+end