POST /project/:id/copy-with-customizations returns 500

## Bug Report

**Severity:** Major
**Found during:** Pre-production stack test (2026-03-26)
**Endpoint:** `POST /project/:projectId/copy-with-customizations`

### Description

Copying a project with customizations crashes with a 500 error. The server attempts to `.push()` on an undefined array during the copy process.

### Steps to Reproduce

```bash
curl -X POST \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"modules":{"annotations":true,"metadata":true}}' \
"https://dev.api.t-pen.org/project//copy-with-customizations"
```

Also tried with different body shapes:
- `{"includeAnnotations":true,"includeMetadata":true}` → 400 "modules must be an object"
- `{"modules":{"annotations":true,"metadata":true,"layers":true,"tools":true,"roles":true,"group":false}}` → 500

### Expected

201 with a new project containing the selected modules.

### Actual

```json
{"status":500,"message":"Cannot read properties of undefined (reading 'push')"}
```

### Analysis

The endpoint in `projectCopyRouter.js` correctly validates that `modules` is an object (returns 400 otherwise), but crashes during the actual copy processing. An array that should be initialized before items are pushed into it is undefined.

The other three copy variants all work correctly:
- `POST /copy` → 201 ✓
- `POST /copy-without-annotations` → 201 ✓
- `POST /copy-with-group` → 201 ✓

### Impact

The Interfaces `copy-with-customization` component cannot create customized project copies.

### Environment

- Stack: dev.api.t-pen.org
- Source project had: 1 layer, 2 pages, lines, custom metadata, columns
- Auth: valid Auth0 JWT