Idempotently link one or more modules to a primary or companion app.

For each moduleId this checks whether the application -> parent_application -> module edge already exists in FGA and writes only the missing edges. The canonical applications.modules list is merged (never pruned) to match.

Resolves {appName} against the durable applications catalog so both deployed apps and the FGA-only companions declared via a host's companionApplications (alias fgaOnlyApplications) block can be targeted by the same endpoint. The catalog row must already exist — a missing application is rejected with 404; create one via POST /api/svc-registry/apps.

Authorization (:func:resolve_module_caller) accepts either:

• a service account bound to the target application — its own runtime SA or its Terraform SA — exactly like the sharable-entity runtime API. Ownership is enforced via :func:_resolve_target_application_for_caller, so a companion can only be extended by its host's runtime/Terraform SA (matched on runtime_owner_application_id); a caller bound to a different application is rejected with 403.
• a human gcp-developers@gocrisp.com member, authorized for any target (the same operator path as POST /apps).

Autonomous registered runtime/Terraform calls need no forwarded user or service FGA grant. A supplied user credential must authorize separately; it never falls back to the autonomous identity on denial.