refactor(audit): extract audit domain into self-contained module

Move the entire audit subsystem (system audit, API audit, import audit,
user lifecycle audit, frontend telemetry) from core into modules/audit/.

Core decoupling via interface-based injection:
- AuditRecorderInterface replaces SystemAuditService in 10+ core services
- UserLifecycleAuditInterface / ImportAuditInterface for specialized flows
- NullAuditRecorder fallback when audit module is disabled
- ApiBootstrap/ApiResponse use null-safe callable resolvers

Module structure (modules/audit/):
- Manifest with routes, permissions, scheduler jobs, authorization policy
- 9 services, 8 repositories, 6 domain enums, 4 job handlers
- 33 page files, 4 JS files, 8 test files, migration scripts, i18n

Core cleanup:
- OperationsAuthorizationPolicy, UiCapabilityMap, PermissionService
  surgically cleaned of audit-specific constants
- Sidebar template cleared of hardcoded audit navigation
- AuditModuleIsolationContractTest ensures no future core→module coupling

All quality gates pass: 1346 tests (19,276 assertions), PHPStan level 5
clean, architecture contracts verified.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/Service/Tenant/TenantService.php

@@ -2,11 +2,10 @@
 
 namespace MintyPHP\Service\Tenant;
 
-use MintyPHP\Domain\Taxonomy\SystemAuditOutcome;
 use MintyPHP\Domain\Taxonomy\TenantStatus;
 use MintyPHP\Repository\Org\DepartmentRepositoryInterface;
 use MintyPHP\Repository\Tenant\TenantRepositoryInterface;
-use MintyPHP\Service\Audit\SystemAuditService;
+use MintyPHP\Service\Audit\AuditRecorderInterface;
 use MintyPHP\Service\Directory\DirectorySettingsGateway;
 
 class TenantService
@@ -15,7 +14,7 @@ class TenantService
         private readonly TenantRepositoryInterface $tenantRepository,
         private readonly DepartmentRepositoryInterface $departmentRepository,
         private readonly DirectorySettingsGateway $settingsGateway,
-        private readonly SystemAuditService $systemAuditService
+        private readonly AuditRecorderInterface $systemAuditService
     ) {
     }
 
@@ -91,7 +90,7 @@ class TenantService
             $this->settingsGateway->setDefaultTenantId((int) $createdId);
         }
 
-        $this->systemAuditService->record('admin.tenants.create', SystemAuditOutcome::Success->value, [
+        $this->systemAuditService->record('admin.tenants.create', 'success', [
             'actor_user_id' => $currentUserId > 0 ? $currentUserId : null,
             'target_type' => 'tenant',
             'target_id' => (int) $createdId,
@@ -155,7 +154,7 @@ class TenantService
             return ['ok' => false, 'errors' => [t('Tenant can not be updated')], 'form' => $form];
         }
 
-        $this->systemAuditService->record('admin.tenants.update', SystemAuditOutcome::Success->value, [
+        $this->systemAuditService->record('admin.tenants.update', 'success', [
             'actor_user_id' => $currentUserId > 0 ? $currentUserId : null,
             'target_type' => 'tenant',
             'target_id' => $tenantId,
@@ -194,7 +193,7 @@ class TenantService
             return ['ok' => false, 'status' => 500, 'error' => 'delete_failed'];
         }
 
-        $this->systemAuditService->record('admin.tenants.delete', SystemAuditOutcome::Success->value, [
+        $this->systemAuditService->record('admin.tenants.delete', 'success', [
             'target_type' => 'tenant',
             'target_id' => $tenantId,
             'target_uuid' => (string) ($tenant['uuid'] ?? ''),