Fix the 1.0.0-alpha5 audit findings

Implements the fixes from the 1.0.0-alpha5 audit (full finding detail and file references are in the module AUDIT.md). Consolidated into one issue/MR per the maintainer request.

High

• Forbid deleting the default tenant, which would brick the engine: a tenant access handler plus list-builder and predelete guards.
• Add the interface-translation directives to 11 submodules so their bundled French translations are actually imported.
• Add a route-access functional test for the public HTTP API (anonymous and under-permissioned requests are rejected).

Medium

• An API consumer with an empty or dangling tenant binding now fails closed instead of falling back to the default tenant.
• Engine spawn() takes the token lock and re-checks committed status before forking.
• The CM form no longer offers a second start node and validates a single start.
• Views attach the tenant cache context independently of the tenant filter, closing a cross-tenant render-cache leak for custom views.
• Lineage resolution batch-loads the parent chain.
• Audit trail gains an opt-in strict mode (re-throw on a chain-write failure) and routes the variable name and scope into the permanent bucket.
• Example workflows no longer carry modeler_api third-party settings, so they install schema-clean without modeler_api.
• Interaction catch-up keeps a branch-scoped link branch-scoped, with no capability widening.

Low

• RedirectInteraction rejects non-http(s) schemes and uses a branch-scoped return token.
• Remove the stray pre-1.0 update hook (the fields install via the install hook).
• Content-task completion re-checks access in the handler.
• Document the forced moderation transition and the full-privilege action execution.
• The ECA event task snapshots and restores the shared token bag around dispatch.
• Variable setValue throws on a json_encode failure instead of losing data; single-row internal reads are deterministic.
• Split the API permission into read and write, cap the variable value size, wrap the API read endpoints, and fix the composer suggest text and description.

Adds tests across the changed areas. Kernel and unit suites pass locally; the functional tests run under CI.