feat: Implement Phase 4 module licensing backend

Build complete module activation and license-module binding system with
marketplace catalog, purchase tracking, and installation status monitoring.

Database schema (migration 009):
- modules table — Registry with pricing, features, plugin URLs
- module_purchases — License-module ownership with transaction logging
- module_installations — Deployment status tracking
- Seed data: Loot Manager module ($9.99)

Backend implementation:
- Domain models with rust_decimal pricing support
- 11 data access functions (catalog, ownership, purchases, installation)
- 5 REST endpoints with JWT auth and license scoping
- Multi-tenant enforcement via license_id from claims

Purchase flow stub:
- Immediate purchase recording without payment gateway
- PayPal integration deferred to XO's direct implementation
- Transaction ID and amount fields ready for real gateway

Module installation:
- Integration with ModuleInstaller service
- NATS-based deployment to companion agent
- Real-time status tracking via polling endpoint

All queries compile-time verified. Zero cross-tenant exposure.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Added (Phase 4 — Module Licensing Backend)
+
+**Backend Infrastructure:**
+- Migration `009_module_licensing.sql` — Module marketplace database schema:
+  - `modules` table — Registry of available modules (slug, name, description, category, price, features, version, plugin URL)
+  - `module_purchases` table — License-module ownership tracking with transaction logging
+  - `module_installations` table — Deployment status tracking (pending, installing, installed, failed)
+  - Seed data: Loot Manager module ($9.99) with features array
+- `backend/src/models/modules.rs` — Domain models:
+  - `Module` struct with rust_decimal pricing support
+  - `ModuleWithOwnership` — Catalog display with is_purchased flag
+  - `ModulePurchase`, `ModuleInstallation` — Purchase and deployment records
+  - `PurchasedModule` — Combined view for user's module library
+- `backend/src/db/modules.rs` — Data access layer (11 query functions):
+  - `get_module_catalog()` — All available modules
+  - `get_catalog_with_ownership(license_id)` — Annotated catalog with purchase status
+  - `get_purchased_modules(license_id)` — User's module library with installation status
+  - `is_module_purchased(license_id, module_id)` — Ownership validation
+  - `record_module_purchase()` — Transaction logging with PayPal ID support
+  - `get_module_installation_status()` / `update_installation_status()` — Deployment tracking
+  - `get_module_by_id()` / `get_module_by_slug()` — Module lookup
+- `backend/src/api/modules.rs` — REST endpoints with auth middleware:
+  - `GET /api/modules/catalog` — Returns modules with is_purchased flag for current license
+  - `GET /api/modules/my-modules` — Purchased modules with installation details
+  - `POST /api/modules/purchase` — Records purchase (stub transaction for Phase 4 MVP — payment integration deferred to XO's direct touch)
+  - `POST /api/modules/install` — Triggers module installation via ModuleInstaller service
+  - `GET /api/modules/:module_id/installation-status` — Real-time deployment status polling
+- Router integration in `main.rs` at `/api/modules` with JWT auth requirement
+- `Cargo.toml` dependency: `rust_decimal` for DECIMAL field support
+
+**Multi-Tenancy Enforcement:**
+- All queries scoped by `license_id` from JWT claims
+- Foreign key constraints enforce license-module binding
+- Purchase validation prevents cross-tenant access
+- Installation status isolated per license
+
+**Payment Integration Strategy:**
+- Purchase endpoint stubs transaction with "STUB_TRANSACTION" ID
+- PayPal integration deferred to XO's direct implementation
+- `transaction_id` and `amount_paid` fields ready for real gateway
+
+**Status:** Module licensing backend operational. Catalog queryable, purchases recordable, ownership enforceable, installation status trackable. Payment gateway integration pending.
+
 ### Added (Phase 4 — Loot Manager Plugin Skeleton)
 
 **Plugin Skeleton:**