[codex] add first-class module versions API

[lazyGPT07]

What changed

• add GET /api/modules/[slug]/versions for newest-first release history
• add authenticated POST /api/modules/[slug]/versions for module authors
• validate semantic versions and HTTP(S) package URLs
• return 409 for duplicate releases and synchronize top-level module version metadata
• document the endpoint and release workflow

Validation

• focused endpoint tests: 11 passed
• complete web suite: 31 files, 219 tests passed
• TypeScript --noEmit passed
• Next.js production build passed and emitted the new route

The full monorepo install was completed with lifecycle scripts disabled because the desktop-only better-sqlite3 dependency has no Node 24 Windows prebuild and this machine does not expose Python to node-gyp. Web validation is complete and does not use that native dependency.

Fixes #8