[mirror] Honor --modules-path-suffix and warn on a moved modules path

[Glitchy-Sheep]

Summary

--modules-path-suffix was accepted by both d8 mirror push and d8 mirror pull but had no effect.

This PR makes it work on both sides, and warns in the pull/push summary when modules end up on a non-default path.

Problem

The flag was parsed into params on both commands and then ignored.

• Push: modules always landed at <repo>/modules/<name>, whatever the flag value. The registry segment came from the unpacked bundle layout, and nothing read the flag.
• Pull: the only reader was validateModulesAccess, which Execute never calls. Real discovery and image pulls hardcoded the modules segment.
• Either way the command reported success with the wrong path, and never told the operator where modules actually went.

Fix

• Push: rewrite the leading modules registry segment to the configured path, for both the layout push and the discovery-index tags.
• Pull: make the modules path configurable in the registry service (WithModulesPathSuffix), and route discovery plus every module reference through one source of truth.
• Both remaps live in registry space only. The bundle keeps its canonical modules/<name> layout on disk, so a mirror pulled with one suffix and pushed with another round-trips cleanly.
• Empty value keeps the default modules; / places modules at the repo root.

Summary warning

• The pull/push summary warns when modules use a non-default path (--modules-path-suffix).
• It shows only the moved Modules row, in yellow, with a dimmed default: hint.
• It fires only when the path was moved AND modules were actually transferred: at least one module pulled or planned on pull, at least one module repo pushed on push.
• A default path, or a moved path no module went through, prints nothing.

Before / After

Before: --modules-path-suffix / is ignored. Push writes to <repo>/modules/<name>, pull reads from <repo>/modules/<name>.

After: push writes to <repo>/<name>, pull reads from <repo>/<name>. Discovery index tags follow the modules to the same repo, and the summary warns about the moved path:

Tests

• TestPushService_ModulesPathSuffix: runs PushService.Push on a fake registry for four suffix values; checks image path, discovery tag, an untouched non-module layout, and the summary (module count, moved flag).
• TestService_ModulesPathSuffix: runs pull module discovery for the same four values; checks discovery and references agree on the source location.
• TestBuildModulesPathReport: resolves the modules path and flags a moved path for default / / / custom / multi-segment values.
• TestWriteModulesPathWarning: silent on a default path and on a moved-but-unused path; shows the moved row with a default: hint; emits colour only when enabled.
• TestRenderPullSummary / TestRenderPushSummary: the warning fires only when the path was moved and modules were transferred.
• Round-trip verified on a local registry: push a module with /, then pull it back with /.

Notes

• Push and pull suffixes are independent. Pull reads from the source suffix; the bundle is always canonical modules/; push applies its own target suffix.
• Help text for both commands was corrected: push describes a target-repo suffix, pull a source-repo suffix (it previously read as a source concept on push).
• Shared summary rendering (colours, box helpers, the moved-path warning) moved to a new internal/mirror/summaryui package so pull and push look identical.
• Small cleanups ride along: a shared PathToSegments helper replaces three copies of the same loop, a single NormalizeModulesPath keeps push and pull in sync, and a dead access-check that encoded the old suffix model is removed.
• The "After" screenshot from the earlier revision is dropped: the summary no longer prints a full registry-layout table, so the block above is the current output. A fresh screenshot can replace the code block if preferred.