refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root
immediately communicates which code is core platform and which lives
in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the
Composer PSR-4 path mapping moves from lib/ to core/.

Module-internal lib/ directories (modules/*/lib/) are untouched.

Updated across the full stack:
- composer.json PSR-4 mapping
- bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php)
- tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer)
- 26 architecture contract tests
- enforcement-policy, guard-catalog, quality-gates
- all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/)
- bin/qa-extended.sh search paths
- .claude/settings.local.json permission paths

Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner →
Executor → Code Review (4 findings fixed) → Security Review →
Acceptance Test → Finalizer)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/App/registerContainer.php

@@ -0,0 +1,101 @@
+<?php
+
+use MintyPHP\App\AppContainer;
+use MintyPHP\App\Container\ContainerRegistrar;
+use MintyPHP\App\Container\Registrars\AccessRegistrar;
+use MintyPHP\App\Container\Registrars\AppServicesRegistrar;
+use MintyPHP\App\Container\Registrars\AuthRegistrar;
+use MintyPHP\App\Container\Registrars\DirectoryRegistrar;
+use MintyPHP\App\Container\Registrars\RepositoryFactoryRegistrar;
+use MintyPHP\App\Container\Registrars\ServiceFactoryRegistrar;
+use MintyPHP\App\Container\Registrars\SettingsRegistrar;
+use MintyPHP\App\Container\Registrars\UserRegistrar;
+use MintyPHP\App\Module\ModuleEventDispatcher;
+use MintyPHP\App\Module\ModuleRegistry;
+use MintyPHP\Service\Audit\ApiAuditServiceInterface;
+use MintyPHP\Service\Audit\ApiSystemAuditReporterInterface;
+use MintyPHP\Service\Audit\AuditMetadataEnricherInterface;
+use MintyPHP\Service\Audit\AuditRecorderInterface;
+use MintyPHP\Service\Audit\ImportAuditInterface;
+use MintyPHP\Service\Audit\NullApiAuditService;
+use MintyPHP\Service\Audit\NullApiSystemAuditReporter;
+use MintyPHP\Service\Audit\NullAuditMetadataEnricher;
+use MintyPHP\Service\Audit\NullAuditRecorder;
+use MintyPHP\Service\Audit\NullImportAudit;
+use MintyPHP\Service\Audit\NullUserLifecycleAudit;
+use MintyPHP\Service\Audit\UserLifecycleAuditInterface;
+
+$container = new AppContainer();
+
+// Order matters: RepositoryFactoryRegistrar and ServiceFactoryRegistrar must run first
+// because later registrars pull concrete services from those factories.
+$registrars = [
+    new RepositoryFactoryRegistrar(),   // raw repository factories (no deps)
+    new ServiceFactoryRegistrar(),      // service factories wired with their repo/gateway deps
+    new AccessRegistrar(),              // RBAC: permissions, roles, authorization
+    new AuthRegistrar(),               // authentication, SSO, tokens
+    new DirectoryRegistrar(),           // tenants, departments, scope
+    new UserRegistrar(),               // user services and repositories
+    new SettingsRegistrar(),           // settings, branding
+    new AppServicesRegistrar(),        // leaf services (stats, search, mail, scheduler, ...)
+];
+
+foreach ($registrars as $registrar) {
+    $registrar->register($container);
+}
+
+// ── Module registrars (run after all Core registrars) ────────────────
+// Module registrars MUST NOT overwrite existing container keys.
+// The ModuleRegistry is stored in the container for downstream access.
+
+$modulesConfig = is_file(__DIR__ . '/../../config/modules.php')
+    ? (array) require __DIR__ . '/../../config/modules.php'
+    : [];
+$enabledModules = ModuleRegistry::resolveEnabledModules($modulesConfig);
+$modulesDir = dirname(__DIR__, 2) . '/modules';
+$moduleRegistry = ModuleRegistry::boot($modulesDir, $enabledModules);
+
+$container->set(ModuleRegistry::class, static fn (): ModuleRegistry => $moduleRegistry);
+$container->set(ModuleEventDispatcher::class, static fn () => new ModuleEventDispatcher(
+    $moduleRegistry->getEventListeners(),
+    $container,
+    $container->has(AuditRecorderInterface::class) ? $container->get(AuditRecorderInterface::class) : null
+));
+
+// Disallow overriding existing core bindings from module registrars.
+$container->protectExistingBindings();
+
+foreach ($moduleRegistry->getContainerRegistrars() as $registrarClass) {
+    if (!class_exists($registrarClass)) {
+        throw new RuntimeException("Module container registrar class not found: {$registrarClass}");
+    }
+    $registrarInstance = new $registrarClass();
+    if (!$registrarInstance instanceof ContainerRegistrar) {
+        throw new RuntimeException(
+            "Module container registrar '{$registrarClass}' must implement " . ContainerRegistrar::class
+        );
+    }
+    $registrarInstance->register($container);
+}
+
+// ── Audit interface fallbacks (null implementations when audit module is disabled) ──
+if (!$container->has(AuditRecorderInterface::class)) {
+    $container->set(AuditRecorderInterface::class, static fn (): AuditRecorderInterface => new NullAuditRecorder());
+}
+if (!$container->has(UserLifecycleAuditInterface::class)) {
+    $container->set(UserLifecycleAuditInterface::class, static fn (): UserLifecycleAuditInterface => new NullUserLifecycleAudit());
+}
+if (!$container->has(ImportAuditInterface::class)) {
+    $container->set(ImportAuditInterface::class, static fn (): ImportAuditInterface => new NullImportAudit());
+}
+if (!$container->has(AuditMetadataEnricherInterface::class)) {
+    $container->set(AuditMetadataEnricherInterface::class, static fn (): AuditMetadataEnricherInterface => new NullAuditMetadataEnricher());
+}
+if (!$container->has(ApiAuditServiceInterface::class)) {
+    $container->set(ApiAuditServiceInterface::class, static fn (): ApiAuditServiceInterface => new NullApiAuditService());
+}
+if (!$container->has(ApiSystemAuditReporterInterface::class)) {
+    $container->set(ApiSystemAuditReporterInterface::class, static fn (): ApiSystemAuditReporterInterface => new NullApiSystemAuditReporter());
+}
+
+return $container;