feat(node-type-registry): sync the registry from constructive-db

[pyramation]

Summary

node-type-registry is authored in constructive-db (next to the platform that consumes it) and published from here. This copy was last touched 2026-07-29; the platform has moved on, and the published 1.14.3 still describes permissions_module, which no longer exists — so dashboard provisioning breaks against current platform until this ships.

Sync, not a rename. What crosses the wire:

permissions_module        -> capabilities_module
DataPermissions           -> DataCapabilities   (slug data_capabilities, field required_capabilities)
AuthzAppMembership.data: { permission: string; permissions: string[] }
                       -> { levels: string[]; capabilities: string[] }
permissionId              -> capabilityId
+ BlueprintPolicy.with_check   (UPDATE policies: separate WITH CHECK node)
+ content-presets              (humanity / metered trust ladders)
+ 8 module types provision_database_modules already accepts
  (content_preset, email_sender, oauth_requests, pages, scope_types,
   user_settings_security, ...)

AuthzAppMembership is the one that isn't just a name: the parameter shape changed, so stored policy JSON written against the old shape does not migrate for free — consumers (dashboard, blocks) have to flip their policy params in the same publish batch.

The published package keeps its own build tooling: src/audit/ and src/generate.ts (which emit constructive-db's pgpm fixtures) are deliberately not copied, and codegen/generate-json.ts is retained.

Two lists of expectations moved with the registry rather than being relaxed: module-types.test.ts here (it snapshots the registry; constructive-db's equivalent derives the same list from provision_database_modules.sql) and agentic/pi's permissions_module:org removal case.

Not in this PR, and worth deciding on: sdk/constructive-sdk is generated from the platform schema and is still pre-rename (permissionId, permissions_module in docstrings). It needs a regeneration run against a renamed server.

Dropped by the sync, flagging deliberately: prefix table-name overrides on the module config types (added here 2026-05-31, never back-ported to constructive-db) and the agent has_chunks / fixed+semantic chunk strategies / tsvector|bm25|trigram search-index unions. The platform does read prefix from module options, so if these should survive they need to be added to the registry in constructive-db — no first-party consumer sets them today.

Link to Devin session: https://app.devin.ai/sessions/8f89acc9280e4cef880921d966e0e8fc
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring