feat: port `app module init` scaffold to Rust

[I-am-nothing]

Follow-up to #8 (the Rust rewrite). The scaffold command was deliberately left out of #8 to keep that PR scoped to auth (login + whoami).

Scope

• Port `mirrorstack app module init ` from the closed Go branch
• Validation: `^[a-z][a-z0-9-]*$`, length 2-40 (already prototyped in the dropped `scaffold/validate.rs`)
• 18 file templates (mirrorstack.yaml, MIRRORSTACK.md, .gitignore, sql/, api/, web/*) — see the closed PR feat(login): mirrorstack login command #6 / pre-rewrite `scaffold/templates.go` for the source of truth
• Atomic create-or-fail on the root directory (no `Path::exists()` TOCTOU)

Reference

The Rust scaffold module was implemented in the rewrite branch and dropped before merge — the code is recoverable from the local repo or the PR #8 history (commit before `refactor: drop app/scaffold; ship login + whoami only`).