Adds SlpModularCms.Api.Slave for local master/slave dev testing (Unit 1)

Relocates ModuleOrchestrator, ServiceCollectionExtensions, and
ApiPrefixConvention from SlpModularCms.Api into SlpModularCms.Core.Hosting
so a new Master-less SlpModularCms.Api.Slave host project (ports 5285/7222)
can share the same bootstrap code without duplicating it. This lets a
developer run a master instance and a slave instance side by side locally
to test the master/slave connection, without touching the existing
master/slave protocol itself.

Relocates the two orchestrator/convention test files from
Modules.Identity.Tests to Core.Tests, dropping an incidental
ProjectReference to SlpModularCms.Api that existed only for those tests.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/SlpModularCms.Api.Slave/appsettings.Development.json

@@ -0,0 +1,39 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "ConnectionStrings": {
+    "DefaultConnection": "Server=(localdb)\\mssqllocaldb;Database=SlpModularCmsSlave;Trusted_Connection=True;MultipleActiveResultSets=true"
+  },
+  "JwtSettings": {
+    "Secret": "SuperSecretKeyForDevelopmentOnly_MustBeLongerThan32Bytes!",
+    "Issuer": "SlpModularCms",
+    "Audience": "SlpModularCmsPortal",
+    "ExpiryMinutes": 60,
+    "RefreshTokenExpiryDays": 7,
+    "CookieSameSite": "None"
+  },
+  "Availability": {
+    "CircuitBreakerSeconds": 30,
+    "StatusCacheSeconds": 1
+  },
+  "Cors": {
+    "AllowedOrigins": [
+      "http://localhost:5174",
+      "https://localhost:5174"
+    ]
+  },
+  "RateLimiting": {
+    "Login": {
+      "PermitLimit": 100,
+      "WindowSeconds": 60
+    },
+    "Refresh": {
+      "PermitLimit": 500,
+      "WindowSeconds": 60
+    }
+  }
+}