feat(security): complete capability messaging workflows

Tiku.Infrastructure/Security/CapabilityAccessEvaluator.cs

@@ -16,12 +16,15 @@ internal sealed class CapabilityAccessEvaluator(TikuDbContext dbContext) : ICapa
         CancellationToken cancellationToken = default)
     {
         var normalized = moduleCode.Trim().ToLowerInvariant();
+        if (!ProductModuleCatalog.Contains(normalized))
+        {
+            return false;
+        }
         var moduleExists = await dbContext.ProductModules.AsNoTracking()
             .AnyAsync(item => item.Code == normalized && item.Status == ProductModuleStatus.Active, cancellationToken);
         if (!moduleExists)
         {
-            // Compatibility while the fixed module catalog is introduced module-by-module.
-            return true;
+            return false;
         }
 
         var tenantActive = await dbContext.Tenants.AsNoTracking()