Add tenant module entitlement administration

tests/test_interface_documentation_contract.py

@@ -22,6 +22,10 @@ class InterfaceDocumentationContractTests(unittest.TestCase):
                 "admin.module-lifecycle.plan",
                 "admin.module-lifecycle.evidence",
             },
+            "admin.tenant-module-entitlements": {
+                "admin.system-tenant-modules",
+                "admin.tenant-modules",
+            },
         }
         for topic_id, contexts in expected.items():
             self.assertIn(topic_id, topics)
@@ -45,9 +49,18 @@ class InterfaceDocumentationContractTests(unittest.TestCase):
                 "admin.section.system-role-templates",
                 "admin.section.system-groups",
                 "admin.section.system-modules",
+                "admin.section.system-tenant-modules",
+                "admin.section.tenant-modules",
             },
         )
 
+    def test_module_administrator_has_only_tenant_module_permissions(self) -> None:
+        permissions = {item.scope for item in manifest.permissions}
+        template = next(item for item in manifest.role_templates if item.slug == "module_admin")
+
+        self.assertEqual({"admin:module:read", "admin:module:write"}, permissions)
+        self.assertEqual(tuple(sorted(permissions)), tuple(sorted(template.permissions)))
+
 
 if __name__ == "__main__":
     unittest.main()