feat(newos4): six interface modes (easy -> cockpit) over one terminal

Symptom: newOS4 had exactly one layout. A first-time user had no way in that did
not require learning commands, and an operator had no surface showing live runtime
state; the only way to see heap/VFS/tool-call telemetry was to type cat /sys/...

Root cause: no UI layer existed. main.html hard-codes one flex column, and
terminal.js binds the stock nodes by id at construction, so an alternative layout
had to either duplicate the output stream or reparent the real nodes.

Fix:
- modules/core/module-uishell.js (new): mode registry, #ui-root, stock-node
  snapshot/restore, identity check that reverts to classic when a mode removes or
  clones #terminal-container, shell-docked #ui-foot (the AI stop button exists in
  every mode), ui command, gated first-run picker, ?ui= honoured only if the mode
  actually registers, lazy mode loading via the same loader ext modules use.
- modules/ext/ui-{easy,chat,studio,workspace,commander,cockpit}.js (new): six
  reparenting skins with scoped CSS. Workspace/commander/cockpit read real /sys/*
  mounts and captured command output; no value on screen is invented.
- modules/test/test-ui-shell.js (new): 25 assertions - teardown, clone rejection,
  failed-mount fallback, footer docking, destructive-mode rejection.
- terminal.js: register the shell; make one failing ext module stop aborting the
  rest of the serial load loop (it did, silently, which is why six ui-* files at
  the end of extKeys never loaded).
- module-loader.js: LATEST_VER v4.6.152. The six ui-* keys are deliberately NOT
  in extKeys - see the rate-limit note below.
- admin/scripts/probe-ui-modes.py (new): 6 modes x 2 viewports plus a --cycle pass
  that switches all seven states on ONE page and asserts the output node keeps its
  identity.

Also fixed, found while testing (pre-existing, production-affecting):
- nginx limit_req zone=webx11 burst 50 -> 200. One newOS4 boot fans out ~40 assets;
  the bucket emptied mid-boot and every later module got 503. Measured in
  webx11.error.log: "limiting requests, excess: 50.696 by zone webx11" against
  modules/ext/ui-chat.js. A reload within ~50 s silently broke modules. Sustained
  rate unchanged at 60r/m.

Verified: node modules/test/test-ui-shell.js -> 25/25; removing both _restoreStock()
calls measures 20/25 with five FAILs; probe-ui-modes.py --cycle against production ->
ALL PASS, 13 checks; served bytes: v4.6.152 x3 in main.html, class UIShellModule x1
in core-bundle.js, six ui-* packages in packages.json.

1 files changed, 20 insertions, 1 deletions

diff --git a/modules/core/terminal.js b/modules/core/terminal.js
index ca6bb61..6bc23b4 100644
--- a/modules/core/terminal.js
+++ b/modules/core/terminal.js
@@ -1382,6 +1382,7 @@
                 this._safeRegister('SmartContextModule', 'smart context');
                 this._safeRegister('SimpleGUIModule', 'simple GUI builder');
                 this._safeRegister('DebugSupervisorModule', 'debug supervisor');
+                this._safeRegister('UIShellModule', 'UI shell');
                 // v4.5.47: Critical ext modules promoted to boot path
                 this._safeRegister('EditorModule', 'editor');
                 this._safeRegister('ShellModule', 'shell');
@@ -1430,6 +1431,7 @@
                     BusyBoxModule: typeof BusyBoxModule !== 'undefined' ? BusyBoxModule : undefined,
                     SmartContextModule: typeof SmartContextModule !== 'undefined' ? SmartContextModule : undefined,
                     DebugSupervisorModule: typeof DebugSupervisorModule !== 'undefined' ? DebugSupervisorModule : undefined,
+                    UIShellModule: typeof UIShellModule !== 'undefined' ? UIShellModule : undefined,
                     BillingModule: typeof BillingModule !== 'undefined' ? BillingModule : undefined,
                 };
                 const cls = registry[className];
@@ -1519,7 +1521,24 @@
                     const pkg = index.packages[key];
                     if (pkg) {
                         const url = pkg.url + (pkg.url.includes('?') ? '&v=' : '?v=') + cacheVer;
-                        await this.moduleManager.loadModuleFromURL(url);
+                        // One bad module must not abort the rest: this loop is serial and used to
+                        // return on the first 404/503/parse error, silently skipping every key
+                        // after it (measured 2026-11-07: a 503 on an earlier key meant the six
+                        // ui-* modes at the end never loaded).
+                        try {
+                            await this.moduleManager.loadModuleFromURL(url);
+                        } catch (e) {
+                            // A 503 here is nginx `limit_req zone=webx11` (60r/m, burst 50): the
+                            // bucket is per-IP, so a boot with many modules drains it and every
+                            // later module is refused. Back off and retry instead of losing the
+                            // module — measured 2026-11-07, six ui-* files 503'd every load.
+                            try {
+                                await new Promise(r => setTimeout(r, 700));
+                                await this.moduleManager.loadModuleFromURL(url);
+                            } catch (e2) {
+                                console.warn(`[Ext] ${key} failed to load: ${e2.message}`);
+                            }
+                        }
                     }
                 }
             }