Add comprehensive module builder with safe draft publishing

[Vlad G (vladpm)]

Summary

Add a complete administrator module-creation and editing experience at /admin/modules/new and /admin/modules/{moduleKey}. This feature-only change is based on current Azure-Samples main and deliberately excludes unrelated local authentication, branding, AI, infrastructure and dependency changes.

Implementation

• Visual sections/questions, options, conditions, repeatable groups, document requirements, workflow/SLA settings, review checklist and per-application-type fees.
• Generic starters, copy existing configuration, JSON import/export, undo/redo, browser recovery, interactive applicant preview and version history.
• Separate inactive drafts from published versions; transactional creation/publication/audit, optimistic editor concurrency and explicit publication confirmation.
• Preserve applications' original module version and support configured application types. Prevent direct intake to draft/disabled/closed modules.
• Integrate configuration validation and evidence limits while preserving current upstream ownership, same-origin, MIME-signature and race-safe workflow protections.
• No database migration, reseed, infrastructure, authentication, branding, AI or runtime dependency changes. Playwright is the only added development dependency.

Validation

• npm run lint (no errors/warnings; existing Biome schema-version informational notice)
• npm run typecheck
• npm test
• npm run build with NODE_ENV=production
• npm audit --audit-level=low: existing upstream lockfile reports 7 advisories (6 high, 1 critical); runtime dependency versions are unchanged and remediation is intentionally outside this feature request
• npm run docs:check
• npm run validate:release on a clean export of the exact staged public files
• 22 module unit/database tests against a disposable local database
• 5 Playwright suites against the production build: create/preview/publish, complete resident renewal submission, original-version preservation, evidence rejection, access control, recovery, failed saves, import/export, concurrency, history, registry toggles and desktop/mobile layouts
• git diff --check
• Bicep unchanged
• Dockerfiles/runtime dependencies unchanged

Review checklist

• The change is focused and follows existing ownership boundaries.
• Tests cover changed behavior and failure paths.
• Documentation and configuration contracts are updated.
• No credentials, Azure identifiers, customer data, personal data, generated output, or large binaries were added.
• Security and privacy impacts were assessed.
• Accessibility was tested for affected user journeys.
• AI behaviour is unchanged.
• Infrastructure and runtime resource configuration are unchanged.
• No database schema change is required.

Deployment is a separate, web-image-only operation. Existing customised/legacy instances must retain their exact source lineage and current features; they must not be replaced wholesale with this upstream image.

[Vlad G (vladpm)]

Hey Thom McKiernan (@thommck) - would you mind approving this PR pls? :)