Set module entitlements

Replaces the tenant's HALO-Lego module entitlements — which product surfaces this tenant has BOUGHT (V3-02). Values are group slugs prefixed module_ (module_work, module_money); the prefix is required, because after these are unioned into the accessor's group slugs it is the only thing separating them from identity groups like contractor. A REPLACE, not a patch: send the full desired set. System-admin only — a tenant_admin passes the route's manage check but must not be able to grant their own tenant a module, which is writing their own invoice. Every leaf's entitlement gate fails CLOSED, so removing a module closes those surfaces on the next resolve.