Add native module registration and scoped application bindings

[forhappy]

Application integration currently requires separate module and topology registration and rebuilding typed client bindings for each tenant. This adds native framework building blocks that register each module with its topology and bind an application once before creating authorized tenant handles.

• cellule-app::CellBinding and ApplicationBuilder::module derive role, shards, and schema range from the module descriptor while keeping stable names, namespace IDs, partition modes, and limits explicit. Topology errors fail before registration hooks. All three partition versions retain byte-identical descriptors compared with explicit CellType declarations.
• ApplicationBinding<A> validates the author type and client registry once, then creates ApplicationHandle<A> with scope(authorized_tenant). Scoped handles retain tenant/application checks and configured read policy and Blob storage. Existing handle constructors use the same validation path.
• CellNode::bind_local_application uses the existing runtime and derives the installation ID from a supplied storage layout. bind_application supports an application-configured client. These helpers preserve the node's existing admission, readiness, and drain ownership.

The standalone Axum/OpenAPI service at crates/cellule-axum/examples/application-builder-service consumes these APIs and retains application-owned authorization, provisioning, listener setup, and command evidence. Its HTTP layer is specific to Axum; compilation and scoped bindings are general framework APIs. The example retains an independent manifest and lockfile so cookbook startup dependencies remain application-owned. It demonstrates two isolated tenants, receipt-bound reads, exact retry/recovery, and HTTP-first shutdown followed by node drain and enrollment withdrawal. Updated guides include ASCII diagrams and compiled registration examples; CI now compiles/lints the standalone service and checks its Rust 1.97 minimum.

Both Axum service examples expose interactive Swagger UI at /docs from one shared HTML page and retain /openapi.json for SDK generation. The original adapter example is named typed-api-service; its specification now includes recovery, authorized scope, and readiness alongside the generated total routes. The UI uses pinned CDN assets, with the browser internet requirement and bearer authorization steps documented.

Managed startup and general schema activation/recovery remain a later framework stage. The runnable service uses the existing schema-version-one cookbook recipe, an in-memory provider, and local fixture credentials, as documented in its README.

Validation:

• All cellule-app and cellule-host tests with all features, including public registration, descriptor compatibility, factory identity, and scope rejection tests, in an isolated snapshot.
• Clippy for both framework crates and the standalone service with warnings denied; strict API documentation.
• Workspace/service formatting, architecture boundaries, module layout, normal dependency tree, Rust fence syntax, and Markdown links.
• Service HTTP smoke: OpenAPI references/security, 401/403, tenant isolation, minimum receipts, retry/conflict, recovery, durable domain rejection, lease renewal, SIGTERM drain, and listener-bind failure cleanup.
• Both example docs pages verified in the browser; Swagger UI authorization and Try it out return an actual successful read. Curl checks cover docs/specification, public readiness, unauthorized rejection and authorized reads on ports 3001 and 3002.