refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root
immediately communicates which code is core platform and which lives
in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the
Composer PSR-4 path mapping moves from lib/ to core/.

Module-internal lib/ directories (modules/*/lib/) are untouched.

Updated across the full stack:
- composer.json PSR-4 mapping
- bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php)
- tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer)
- 26 architecture contract tests
- enforcement-policy, guard-catalog, quality-gates
- all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/)
- bin/qa-extended.sh search paths
- .claude/settings.local.json permission paths

Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner →
Executor → Code Review (4 findings fixed) → Security Review →
Acceptance Test → Finalizer)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/App/Module/Contracts/EventListener.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+/**
+ * Interface for module event listeners.
+ *
+ * Modules declare listeners in their manifest under 'event_listeners'.
+ * The dispatcher resolves listeners from the container and calls handle().
+ */
+interface EventListener
+{
+    /**
+     * @param string $event Event name (e.g. 'user.deleted')
+     * @param array<string, mixed> $payload Event-specific data
+     */
+    public function handle(string $event, array $payload): void;
+}

core/App/Module/Contracts/LayoutContextProvider.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+use MintyPHP\App\AppContainer;
+
+/**
+ * Provides module-specific data for the layout navigation context.
+ *
+ * Called from appBuildLayoutNavContext() after Core data assembly.
+ * Return value is merged into the $layoutNav array passed to templates.
+ *
+ * IMPORTANT: Only called in web request context. CLI/scheduler callers
+ * must not invoke layout context providers. Implementations should use
+ * try/catch around request-dependent calls (e.g. requestInput()) as a
+ * defensive measure.
+ */
+interface LayoutContextProvider
+{
+    /**
+     * @param array<string, mixed> $session Current session data
+     * @return array<string, mixed> Key-value pairs to merge into $layoutNav
+     */
+    public function provide(array $session, AppContainer $container): array;
+}

core/App/Module/Contracts/ModuleDeactivationHandler.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+use MintyPHP\App\AppContainer;
+
+/**
+ * Handles cleanup when a module is deactivated.
+ *
+ * Invoked by `php bin/console module:deactivate` after a module has been removed
+ * from the enabled list. The handler receives the full app container and
+ * can perform cleanup tasks like removing orphaned data or revoking permissions.
+ */
+interface ModuleDeactivationHandler
+{
+    public function deactivate(AppContainer $container): void;
+}

core/App/Module/Contracts/SearchResourceProvider.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+/**
+ * Provides search resources contributed by a module.
+ *
+ * Each provider returns a list of search resources (with SQL for count/preview/result),
+ * maps result rows to display items, and provides list URLs for deep-linking.
+ */
+interface SearchResourceProvider
+{
+    /**
+     * Return search resource definitions.
+     *
+     * Supported SQL placeholders (replaced before parameter binding):
+     * - `{{tenantFilter}}` — replaced with a tenant-scope WHERE clause (or empty string)
+     * - `{{userId}}`       — replaced with the current user's ID (integer, safe for inline SQL)
+     *
+     * All remaining `?` placeholders are bound to the LIKE search term.
+     * The last `?` in preview_sql is reserved for the preview limit.
+     *
+     * @return array<string, array{
+     *     label: string,
+     *     permission: string,
+     *     count_sql: string,
+     *     preview_sql: string,
+     *     result_sql: string,
+     *     tenant_filter?: string
+     * }>
+     */
+    public function resources(): array;
+
+    /**
+     * Map a raw result row to a display-ready item.
+     *
+     * @param array<string, mixed> $row
+     * @return array{title: string, subtitle?: string, url: string, icon?: string}|null
+     */
+    public function mapResultItem(string $resourceKey, array $row): ?array;
+
+    /**
+     * Return the list URL for the given resource key and encoded search term.
+     */
+    public function listUrl(string $resourceKey, string $encodedSearch): string;
+}

core/App/Module/Contracts/SessionProvider.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+use MintyPHP\App\AppContainer;
+
+/**
+ * Populates module-specific session data after login and cleans up on logout.
+ *
+ * Called from the login flow after successful authentication. When a module is
+ * deactivated, its provider is not called — session keys are simply not set.
+ */
+interface SessionProvider
+{
+    /**
+     * Populate session keys with module-specific data after successful login.
+     *
+     * @param array<string, mixed> $user The authenticated user record
+     */
+    public function populate(array $user, AppContainer $container): void;
+
+    /**
+     * Remove session keys owned by this module (called on logout).
+     */
+    public function clear(AppContainer $container): void;
+}