Extract channel/session modules and CLI guard, move UME sidebands out of main, and default NETX_RUN_INLINE_SCHEDULERS off so ops run python -m netx_api.worker.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add capability RBAC, Alembic bootstrap, optional worker schedulers, and close public docs by default so lab installs stay usable without shared signing keys.
Co-authored-by: Cursor <cursoragent@cursor.com>