feat: community module installer in Settings > Extensions

[itsDNNS]

Summary

Users can now browse and install community modules directly from Settings > Extensions, without manually mounting directories or copying files.

Generic Module Downloader

• Extracted secure GitHub download logic from theme_registry.py into app/module_download.py
• Fully recursive directory traversal (any depth, any structure)
• download_theme() refactored to thin wrapper around generic downloader
• HTTPS-only, trusted GitHub hosts only (SSRF protection preserved)

API Endpoints

• GET /api/modules/registry -- fetch available modules with install status (disk detection via manifest scan, not live loader state)
• POST /api/modules/install -- download, validate (validate_manifest() + ID match), install disabled-by-default
• POST /api/modules/uninstall -- remove community module, builtin protection
• Path traversal protection via realpath validation on all install/uninstall paths
• Pre-install: duplicate ID check against builtins + existing community modules
• Post-download: full manifest validation, cleanup on failure

Extensions UI

• Community Modules section with Browse button
• Module cards showing name, description, author, version, verified badge, install status
• Install/Uninstall buttons with restart banner
• Auto-loads on section switch

Other

• module_registry_url config key (env: MODULE_REGISTRY_URL)
• MODULES_DIR centralized (no more hardcoded /modules)
• 14 i18n keys across EN/DE/FR/ES

Closes #249

Test plan

• 9 module download unit tests (URL validation, registry parsing)
• 1722 total tests pass (0 failures)
• i18n validation passes
• Theme install regression verified (refactored patches updated)