Laterite 0.3.0

Breaking

• Applications boot through laterite_admin::Bootstrap with a ModuleRegistry of
  Module implementations; router takes the module contributions, an
  AdminConfig, and the catalog store.
• AdminConfig, AppMeta, and BackendConfig are #[non_exhaustive]: build one
  with Default and set fields. Struct literals no longer compile outside the
  framework, and a field added in a later release is additive.
• Descriptor labels (lists, forms, resources, settings items, permissions) are
  Text values built with the t! macro; a bare String no longer compiles.

Added

• Module system: the Module trait with bundled migrations run in dependency
  order, a registration Registry for descriptors and hooks, and database
  capability declarations checked at boot.
• Plugin platform: plugins/<author>/<plugin> discovery with a generated manifest
  (lat plugin sync), enable and disable from config and the admin, and boot
  isolation with quarantine and a crash-loop journal.
• Localization: the deferred Text value with t!, tn!, and tp!; a
  per-request translator resolving the operator preference, Accept-Language,
  and app.locale; a language picker; PO catalogs contributed by modules; the
  xx pseudo-locale; localized dates; and lat i18n extract, check, update,
  and status.
• Audit log: an append-only record of every privilege and data mutation, with a
  read-only view under System behind backend.view_audit_log.
• Admin sessions with layered CSRF protection and dismissible flash toasts.
• A validation engine with typed rules (required, length, email, url, unique) and
  per-field errors re-rendered with a 422.
• Typed admin errors with styled pages, logged through tracing; app.debug
  shows the cause.
• Field types as an open registry with a view-model render seam: text input types
  (email, tel, number, url with a copy button), select, and a reference picker
  with a searchable combobox; form writes delegated to registered persisters; a
  ColumnType registry for list cells.
• Admin assets: htmx, a laterite.js widget lifecycle, and an open asset registry
  with per-page widget assets.
• CLI: lat serve, lat domain for local wildcard domains, and
  lat make:migration.
• Config: server.listen, app.url, app.locale, app.debug, and
  backend.path to relocate the admin panel.
• Core helpers: insert_returning_id_on for transactional inserts,
  AnyRowExt::get_int, and like_escape.

Fixed

• Absent form values persist correctly, and the migration scaffold declares its
  primary key.
• Form field options resolve once at router build.
• Locale names and date formatting assume no particular language; the admin's
  locale set is the loaded catalogs.

Security

• A resource with a create or edit form must declare a permission; boot aborts
  otherwise.
• The reference-picker search escapes LIKE wildcards.