feat: detect and gate pending install migrations

[anonymoususer72041]

Summary

This PR adds automatic detection for pending install schema migrations and prevents OpenCATS from continuing normal operation while those migrations still need to be finalized.

It introduces a central read-only migration status check for the install schema, blocks normal module schema processing from silently applying or finalizing install migrations during regular requests and shows a maintenance message for the Careers Portal while install migrations are pending.

For authenticated users, pending migrations are now handled through an application-level gate. Site administrators are shown a warning with an action that opens the install module maintenance flow through the normal OpenCATS front controller. Recruiters and other non-admin users are shown a message telling them to contact their administrator.

The actual migration execution remains handled by the existing install:maint AJAX maintenance flow. Fresh installations without INSTALL_BLOCK remain compatible with the existing installer behavior, while installed systems require an authenticated site administrator and a CSRF token before maintenance can run.

The integration test setup now finalizes the install schema version dynamically from modules/install/Schema.php, so CI test databases represent an already finalized installed snapshot without hard-coding the current install schema version in db/cats_schema.sql.

Motivation

Previously, pending install schema migrations could be difficult to notice during normal application usage. This could allow users to continue using OpenCATS while the database schema was not fully aligned with the application code and the Careers Portal could remain publicly available during that state.

Detecting pending migrations centrally makes this state explicit and safer. Blocking the Careers Portal avoids exposing applicants to an application that still requires maintenance, while gating authenticated application requests prevents existing sessions or direct module URLs from bypassing the warning.

Using the existing install module and install:maint maintenance flow keeps the implementation close to current OpenCATS behavior and avoids introducing a second migration execution path.