refactor(ui): put every PHP-to-JS config blob behind one emitter and one reader

[HugoFara]

Stack 4 of 6. Base: #300. Two commits: the config-island unification, and
the CLAUDE.md correction that describes it and the two PRs before it.

Config islands

Server values reach a page as a JSON island because the CSP build of Alpine
cannot evaluate inline expressions. The pattern is sound; the plumbing was not.
35 islands each hand-rolled their own script tag and escaping flags, and
eight pages hand-rolled their own reader, so the two ends of each contract could
drift with nothing to catch it.

Adds ConfigIsland (PHP) and readPageConfig / hasPageConfig (TypeScript),
and routes all of it through them. Three concrete bugs this fixes:

• Six islands emitted json_encode with no escaping flags at all, so a
  value containing </script> would close the element early and the rest of the
  blob would parse as markup.
• preferences.php hand-spliced a pre-JSON-encoded value into a literal
  {"currentLanguageCode": …} — valid only as long as the controller remembered
  to encode it. It now passes the plain string and the controller stops
  encoding.
• starter_vocab.ts parsed without a try/catch, so a malformed blob
  threw during init() and left the user an inert shell. readPageConfig never
  throws: missing element, empty blob and bad JSON all fall back to the caller's
  defaults, merged shallowly with null treated as absent.

JsonScriptBlockEscapingTest now pins a stronger invariant than the old flag
scan. One test feeds the emitter a payload that tries to close its own script
element and checks the rendered output; the other asserts no file outside
ConfigIsland emits a config block, so a new view cannot quietly reintroduce
the hand-rolled form.

Docs

CLAUDE.md was routing work to src/backend/Views, src/backend/Services and
src/backend/Router, none of which exist — what remains under src/backend is
the REST API and the entry point. It also named getSettingWithDefault(),
Globals::table(), global $var, the archivedtexts and textitems2 tables,
and a frontend laid out as pgm.ts / text_events.ts / audio_controller.ts.
All gone: archived texts are a TxArchivedAt column on texts, and
textitems2 is word_occurrences.

Corrects the request flow, directory tree, table list and frontend layout, adds
the missing Activity and Book modules, and documents the config-island pattern
as the only sanctioned way to move values from PHP to a page.

Stack: #298 → #299 → #300 → 4 → #5 → #6