fix: address remaining issues from downstream feedback

[antosubash]

Closes the four issues left open after #127 and #139.

#137 — Document IModulePermissions for downstream module authors

• sm new module <Name> now scaffolds <Name>Permissions.cs with a starter
  sealed class implementing IModulePermissions plus four conventional
  constants. The pattern is now visible in every freshly-scaffolded module
  instead of read-the-source-only.
• modules/Permissions/src/SimpleModule.Permissions/README.md gains a
  worked example targeted at consumers writing their own modules
  (MyApp.Customers / CustomersPermissions), points at the framework
  guide, and notes the auto-discovery behavior.
• docs/CONSTITUTION.md clarifies that ConfigurePermissions is no
  longer required — the source generator picks up IModulePermissions
  implementations automatically.

#135 — Real-consumer smoke test for packed nupkgs

scripts/smoke-test-nupkg-consumer.mjs:

1. Discovers UI-shipping modules under modules/.
2. Spins up a temp Microsoft.NET.Sdk.Web consumer at
   mkdtemp()/Consumer.csproj whose nuget.config points at the local
   nupkgs/ feed.
3. PackageReferences every UI module by id at the requested version.
4. dotnet restore && dotnet build -c Release.
5. Asserts the consumer's staticwebassets.build.json references
   _content/{Module}/{Module}.pages.js for each module.

Wired into the existing pack-smoke job in .github/workflows/ci.yml
right after verify-nupkg-static-assets.mjs. Catches the regression class
where a package looks fine on disk but its MSBuild props/targets fail to
contribute static assets to a real consumer build — invisible to
template/SimpleModule.Host because it uses ProjectReference.

Verified locally: all 19 UI module packages pass the consumer build check.

#133 — Extract SimpleModule.Testing

Adds a new packable framework project framework/SimpleModule.Testing containing only the truly cross-app integration-test surface:

• TestAuthDefaults — AuthenticationScheme = "TestScheme", ClaimsHeader = "X-Test-Claims".
• TestAuthHandler — header-based test auth.
• services.AddTestAuthentication() extension.
• WebApplicationFactory<TEntryPoint>.CreateAuthenticatedClient(params Claim[]) and (string[] permissions, params Claim[]) extensions.

SimpleModule.Tests.Shared now ProjectReferences it and re-exports
TestAuthScheme for backward compatibility. The 20+ module ProjectReferences and module-specific fixture wiring stay in Tests.Shared (still IsPackable=false); the new package is intentionally narrow so it can ship without dragging the world along.

SimpleModule.Testing picks up IsPackable=true from
framework/Directory.Build.props so it'll be packed automatically by the existing release workflow.

#130 — Boot-time peer-module validator

Adds ModuleGraphValidator (IHostedService, opt-in via
SimpleModuleOptions.ValidateModuleGraph, default true outside
Production). Walks AppDomain.CurrentDomain.GetAssemblies() for
SimpleModule.X.Contracts assemblies, enumerates their I*Contracts
interfaces, and logs a LogWarning for every interface with no
registered implementation:

Module graph: contract IFooContracts is referenced but no implementation is registered. The module providing it (SimpleModule.Foo) appears to be missing — add a PackageReference (or call its registration extension) to fix runtime resolution failures.

Skipped in Production where downstream apps may legitimately ship a
contracts assembly without the impl. This addresses the generic case from
#130 — the two specific peer-dep crashes (Admin→OpenIddict,
Email→BackgroundJobs) were already caught with directive errors in #127.

Test plan

• dotnet build clean across the full solution.
• dotnet test modules/Users/tests/... — 40 passed.
• dotnet test modules/Admin/tests/... — 28 passed, 1 skipped.
• dotnet test modules/OpenIddict/tests/... — 20 passed.
• dotnet test tests/SimpleModule.Core.Tests/... — 209 passed.
• dotnet test tests/SimpleModule.Generator.Tests/... — 195 passed.
• node scripts/verify-nupkg-static-assets.mjs ./nupkgs — 19 verified.
• node scripts/smoke-test-nupkg-consumer.mjs ./nupkgs --version 0.0.0-ci — 19 verified end-to-end.
• SimpleModule.Testing.0.0.0-ci.nupkg is produced by dotnet pack.
• Manual: drop OpenIddict from a downstream app and observe ModuleGraphValidator warning at startup.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying simplemodule-website with    Cloudflare Pages

Latest commit:	1a89bee
Status:	✅  Deploy successful!
Preview URL:	https://353e9e38.simplemodule-website.pages.dev
Branch Preview URL:	https://claude-fix-remaining-issues.simplemodule-website.pages.dev

View logs