Moving module data between Personal and an Org

Sometimes data starts in one context and graduates to another. The most common case: you've been collecting your favorite recipes in Personal Menu Planner for months, and now you're starting a restaurant. Those recipes should become the seed of your restaurant's menu without re-typing.

Module Portability is the platform's primitive for this. One callable, `moveModuleData`, orchestrates the move; each module declares its own copier function that knows how to map between contexts.

Today's supported moves (more arrive incrementally as modules opt in):

• **menuPlanner** → in roadmap: Personal recipes → Org restaurant menu items. The schema mapping (Recipe → MenuItem with ingredients + modifiers) is wired up as the Restaurant module opts in. Today's stub supports Personal → Personal for sanity testing.

Audit + safety:

• Every move writes to `portabilityMoves/{moveId}` with a summary of what was copied + what was skipped. You can review any move in your account history.
• Moves are COPIES, not cuts. The source-side data is not deleted by default. You can pass `archiveSource: true` to mark the source archived (still visible in history; hidden from the active surface).
• Permission check: you must have read access on the source (it's your Personal data, or you're an admin of the source org) and the platform enforces the destination's normal write rules.

What's NOT supported (yet):

• Moving an org's customers out of the org — even an owner can't take the org's CRM with them on departure. The customers belong to the org, not to the person.
• Moving paystubs out of an org — those belong to the employee, not the org admin. The data-portability story for that is owner-side (your paystubs survive leaving the org because they're under your Personal context already).
• Hard delete from source. Always a copy.

How to trigger a move (today): from the source module's settings page, look for "Move to another context" — surfaces once a copier is registered for that module. Pick the target context (your other Personal account, another org you admin), confirm the preview, and the move executes. Audit row + counts return in the response.