refactor(audit): extract audit domain into self-contained module

Move the entire audit subsystem (system audit, API audit, import audit,
user lifecycle audit, frontend telemetry) from core into modules/audit/.

Core decoupling via interface-based injection:
- AuditRecorderInterface replaces SystemAuditService in 10+ core services
- UserLifecycleAuditInterface / ImportAuditInterface for specialized flows
- NullAuditRecorder fallback when audit module is disabled
- ApiBootstrap/ApiResponse use null-safe callable resolvers

Module structure (modules/audit/):
- Manifest with routes, permissions, scheduler jobs, authorization policy
- 9 services, 8 repositories, 6 domain enums, 4 job handlers
- 33 page files, 4 JS files, 8 test files, migration scripts, i18n

Core cleanup:
- OperationsAuthorizationPolicy, UiCapabilityMap, PermissionService
  surgically cleaned of audit-specific constants
- Sidebar template cleared of hardcoded audit navigation
- AuditModuleIsolationContractTest ensures no future core→module coupling

All quality gates pass: 1346 tests (19,276 assertions), PHPStan level 5
clean, architecture contracts verified.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/audit/tests/Module/Audit/Service/ApiAuditServiceTest.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Audit\Service;
+
+use MintyPHP\Http\RequestContext;
+use MintyPHP\Http\RequestRuntime;
+use MintyPHP\Module\Audit\Repository\ApiAuditLogRepositoryInterface;
+use MintyPHP\Module\Audit\Service\ApiAuditService;
+use PHPUnit\Framework\TestCase;
+
+class ApiAuditServiceTest extends TestCase
+{
+    private array $serverBackup = [];
+    private array $getBackup = [];
+
+    protected function setUp(): void
+    {
+        $this->serverBackup = $_SERVER;
+        $this->getBackup = $_GET;
+        RequestContext::resetForTests();
+    }
+
+    protected function tearDown(): void
+    {
+        $_SERVER = $this->serverBackup;
+        $_GET = $this->getBackup;
+        RequestContext::resetForTests();
+    }
+
+    public function testCurrentRequestIdIsNullBeforeStart(): void
+    {
+        $service = new ApiAuditService(
+            $this->createMock(ApiAuditLogRepositoryInterface::class),
+            new RequestRuntime()
+        );
+        $this->assertNull($service->currentRequestId());
+    }
+
+    public function testCurrentRequestIdIsGeneratedForRegularRequests(): void
+    {
+        $_SERVER['REQUEST_METHOD'] = 'GET';
+        $_SERVER['REQUEST_URI'] = '/api/v1/me?x=1';
+        $_GET = ['x' => '1'];
+
+        $service = new ApiAuditService(
+            $this->createMock(ApiAuditLogRepositoryInterface::class),
+            new RequestRuntime()
+        );
+        $service->startRequestContext();
+
+        $requestId = $service->currentRequestId();
+        $this->assertNotNull($requestId);
+        $this->assertMatchesRegularExpression(
+            '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i',
+            $requestId
+        );
+
+        $service->startRequestContext();
+        $this->assertSame($requestId, $service->currentRequestId());
+    }
+
+    public function testCurrentRequestIdStaysNullForOptionsRequests(): void
+    {
+        $_SERVER['REQUEST_METHOD'] = 'OPTIONS';
+        $_SERVER['REQUEST_URI'] = '/api/v1/me';
+        $_GET = [];
+
+        $service = new ApiAuditService(
+            $this->createMock(ApiAuditLogRepositoryInterface::class),
+            new RequestRuntime()
+        );
+        $service->startRequestContext();
+
+        $this->assertNull($service->currentRequestId());
+    }
+}