docs: update all docs for sessions, solver, approvals, and recent features

- STATUS.md: migration count 18→23, endpoint count 86→~140, add approval
  workflows, solver service, workstations, edit sessions, SSE targeted
  delivery rows, update test file count 9→31, add migrations 019-023
- MODULES.md: add solver and sessions to registry, dependencies, endpoint
  mappings (sections 3.11, 3.12), discovery response, admin settings,
  config YAML, and future considerations
- CONFIGURATION.md: add Approval Workflows, Solver, and Modules config
  sections, add SILO_SOLVER_DEFAULT env var
- ROADMAP.md: mark Job Queue Complete (Tier 0), Audit Trail Complete
  (Tier 1), Approval/ECO Complete (Tier 4), update Workflow Engine tasks,
  add Recently Completed section, update counts, resolve job queue question
- GAP_ANALYSIS.md: mark approval workflow Implemented, locking Partial,
  update workflow comparison (C.2), update check-in/check-out to Partial,
  task scheduler to Full, update endpoint counts, rewrite Appendix A
- INSTALL.md: add MODULES.md, WORKERS.md, SOLVER.md to Further Reading
- WORKERS.md: status Draft→Implemented
- SOLVER.md: add spec doc, mark Phase 3b as complete

docs/MODULES.md

@@ -1,7 +1,7 @@
 # Module System Specification
 
 **Status:** Draft
-**Last Updated:** 2026-02-14
+**Last Updated:** 2026-03-01
 
 ---
 
@@ -36,6 +36,8 @@ These cannot be disabled. They define what Silo *is*.
 | `freecad` | Create Integration | `true` | URI scheme, executable path, client settings |
 | `jobs` | Job Queue | `false` | Async compute jobs, runner management |
 | `dag` | Dependency DAG | `false` | Feature DAG sync, validation states, interference detection |
+| `solver` | Solver | `false` | Assembly constraint solving via server-side runners |
+| `sessions` | Sessions | `true` | Workstation registration, edit sessions, and presence tracking |
 
 ### 2.3 Module Dependencies
 
@@ -46,6 +48,8 @@ Some modules require others to function:
 | `dag` | `jobs` |
 | `jobs` | `auth` (runner tokens) |
 | `odoo` | `auth` |
+| `solver` | `jobs` |
+| `sessions` | `auth` |
 
 When enabling a module, its dependencies are validated. The server rejects enabling `dag` without `jobs`. Disabling a module that others depend on shows a warning listing dependents.
 
@@ -257,6 +261,34 @@ PUT    /api/items/{partNumber}/dag
 POST   /api/items/{partNumber}/dag/mark-dirty/{nodeKey}
 ```
 
+### 3.11 `solver`
+
+```
+GET    /api/solver/jobs
+GET    /api/solver/jobs/{jobID}
+POST   /api/solver/jobs
+POST   /api/solver/jobs/{jobID}/cancel
+GET    /api/solver/solvers
+GET    /api/solver/results/{partNumber}
+```
+
+### 3.12 `sessions`
+
+```
+# Workstation management
+GET    /api/workstations
+POST   /api/workstations
+DELETE /api/workstations/{workstationID}
+
+# Edit sessions (user-scoped)
+GET    /api/edit-sessions
+
+# Edit sessions (item-scoped)
+GET    /api/items/{partNumber}/edit-sessions
+POST   /api/items/{partNumber}/edit-sessions
+DELETE /api/items/{partNumber}/edit-sessions/{sessionID}
+```
+
 ---
 
 ## 4. Disabled Module Behavior
@@ -431,6 +463,18 @@ GET /api/modules
       "required": false,
       "name": "Dependency DAG",
       "depends_on": ["jobs"]
+    },
+    "solver": {
+      "enabled": false,
+      "required": false,
+      "name": "Solver",
+      "depends_on": ["jobs"]
+    },
+    "sessions": {
+      "enabled": true,
+      "required": false,
+      "name": "Sessions",
+      "depends_on": ["auth"]
     }
   },
   "server": {
@@ -518,7 +562,9 @@ Returns full config grouped by module with secrets redacted:
     "job_timeout_check": 30,
     "default_priority": 100
   },
-  "dag": { "enabled": false }
+  "dag": { "enabled": false },
+  "solver": { "enabled": false, "default_solver": "ondsel" },
+  "sessions": { "enabled": true }
 }
 ```
 
@@ -632,6 +678,11 @@ modules:
     default_priority: 100
   dag:
     enabled: false
+  solver:
+    enabled: false
+    default_solver: ondsel
+  sessions:
+    enabled: true
 ```
 
 If a module is not listed under `modules:`, its default enabled state from Section 2.2 applies. The `auth.enabled` field continues to control the `auth` module (no duplication under `modules:`).
@@ -732,6 +783,7 @@ These are read-only in the UI (setup-only via YAML/env). The "Test" button is av
 - **Per-module permissions** — beyond the current role hierarchy, modules may define fine-grained scopes (e.g., `jobs:admin`, `dag:write`).
 - **Location & Inventory module** — when the Location/Inventory API is implemented (tables already exist), it becomes a new optional module.
 - **Notifications module** — per ROADMAP.md Tier 1, notifications/subscriptions will be a dedicated module.
+- **Soft interference detection** — the `sessions` module currently enforces hard interference (unique index on item + context_level + object_id). Soft interference detection (overlapping dependency cones) is planned as a follow-up.
 
 ---