feat: per-user module access, classification watchlists, watchlist persistence & move

**Module access control (admin)**
- Added modules column to users table (JSON array of allowed module keys)
- auth.me returns modules; admin.setUserModules/disableUser/enableUser/deleteUser procedures
- UserActions dropdown with Reset Password, Manage Modules, Disable/Enable, Delete
- useFeatureAccess hook + FeatureGate component for page-level gating
- SidebarNav, CommandPalette, MobileTabNav filter by modules

**Classification watchlists (auto-generated sector/thematic/style/region)**
- watchlists schema: added kind, class_key, class_label columns
- materializeClassificationWatchlists(): lazy idempotent materialization of system lists from Yahoo sector data
- 11 GICS sector lists, Semiconductors, Biotech thematic lists, Small Cap style, Intl region
- Materialization triggered on listWatchlists + addSymbol/removeSymbol/add
- Sector thematic filter uses industry keywords (semiconductors, biotech) to avoid misclassification
- Symbol overrides fixed: IREN removed from SMH theme, bitcoin miners XLE->XLK, SLNH added as Technology

**Watchlist persistence & move**
- active-watchlist-store.ts: Zustand persist store mirroring active-symbol-store pattern
- moveSymbol procedure: removes from source, adds to target (idempotent, preserves empty lists)
- Action menu (⋯) per row: Move to + Remove, click-outside close
- Active watchlist survives navigation and page reloads

**List protections**
- default list: non-deletable, non-renamable, keeps empty row when pruned
- System lists (sector/thematic etc.): read-only, add form hidden, no remove/move/delete

**Per-user module restrictions**
- ProtectedProcedure blocks non-active users
- deleteUser refuses self-delete and last-admin-delete, cleans halt_state manually
- Module gating on execution/analytics pages, sidebar, command palette, mobile nav

Also fixed: schema.sql index moved to migration, materialize DB column fixes, test updates.

app/server/src/db/schema.sql

@@ -22,6 +22,7 @@ CREATE TABLE IF NOT EXISTS users (
   convexity_posture TEXT NOT NULL DEFAULT 'off',        -- off|covered_income|cash_secured_entry|insurance_sleeve|leaps_conviction
   backup_codes_hashed TEXT,                        -- JSON array of scrypt-hashed backup codes (slice 2)
   status             TEXT NOT NULL DEFAULT 'active',  -- active|pending_approval|rejected (user provisioning)
+  modules            TEXT NOT NULL DEFAULT '["research","settings"]',  -- JSON array of allowed module keys
   created_at         TEXT NOT NULL
 );
 
@@ -253,16 +254,17 @@ CREATE TABLE IF NOT EXISTS symbol_demand (
 
 -- ===== Tier C — Per-user (ownerId NOT NULL) =====
 CREATE TABLE IF NOT EXISTS watchlists (
-  id         TEXT PRIMARY KEY,
-  owner_id   TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-  name       TEXT NOT NULL,
-  symbols    TEXT NOT NULL,               -- JSON array
-  created_at TEXT NOT NULL,
-  sort_order INTEGER NOT NULL DEFAULT 0
+  id           TEXT PRIMARY KEY,
+  owner_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  name         TEXT NOT NULL,
+  symbols      TEXT NOT NULL,               -- JSON array
+  created_at   TEXT NOT NULL,
+  sort_order  INTEGER NOT NULL DEFAULT 0,
+  kind         TEXT NOT NULL DEFAULT 'user',  -- 'user' | 'sector' | 'thematic' | 'style' | 'region'
+  class_key   TEXT,                         -- ETF symbol for derived lists (XLK, SMH...); NULL for user
+  class_label TEXT                         -- human label synced with market outlook; NULL for user
 );
 
-CREATE UNIQUE INDEX IF NOT EXISTS idx_watchlists_owner_name ON watchlists(owner_id, name);
-
 CREATE TABLE IF NOT EXISTS portfolio_holdings (
   id          TEXT PRIMARY KEY,
   owner_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,