Invalidate tenant entitlements after module changes

src/govoplan_admin/backend/api/v1/routes.py

@@ -911,6 +911,7 @@ def update_system_tenant_modules(
         audit_event="tenant_modules.system_policy_updated",
     )
     session.commit()
+    lifecycle.registry.invalidate_tenant_entitlement(tenant.id)
     return TenantModuleEntitlementResponse.model_validate(
         module_entitlement_payload(tenant.id, state)
     )
@@ -988,6 +989,7 @@ def update_tenant_modules(
         ),
     )
     session.commit()
+    lifecycle.registry.invalidate_tenant_entitlement(tenant.id)
     return TenantModuleEntitlementResponse.model_validate(
         module_entitlement_payload(tenant.id, state)
     )

src/govoplan_admin/backend/manifest.py

@@ -91,7 +91,7 @@ manifest = ModuleManifest(
             title="Govern modules per tenant",
             summary="System administrators set each tenant's module ceiling and forced modules; tenant module administrators choose within that ceiling.",
             body=(
-                "Deployment activation installs and loads module code for the whole instance. Tenant module governance is a separate entitlement layer: system administrators mark modules unavailable, available, or forced for a tenant and may also change that tenant's selection. A tenant module administrator can only enable or disable available modules; forced modules and required dependencies remain effective. Module entitlement never grants permissions, and malformed policy fails closed to protected administration modules. Enabling a capability module such as Encryption only makes its services available; data encryption remains an explicit owning-module policy or migration decision."
+                "Deployment activation installs and loads module code for the whole instance. Tenant module governance is a separate entitlement layer: system administrators mark modules unavailable, available, or forced for a tenant and may also change that tenant's selection. A tenant module administrator can only enable or disable available modules; forced modules and required dependencies remain effective. Module entitlement never grants permissions, and malformed policy fails closed to protected administration modules. Disabling a module stops new API, capability, schedule, and worker admission for that tenant; accepted durable work remains queued and requires an operator decision rather than being executed or discarded. Enabling a capability module such as Encryption only makes its services available; data encryption remains an explicit owning-module policy or migration decision."
             ),
             layer="configured",
             documentation_types=("admin",),