refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root
immediately communicates which code is core platform and which lives
in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the
Composer PSR-4 path mapping moves from lib/ to core/.

Module-internal lib/ directories (modules/*/lib/) are untouched.

Updated across the full stack:
- composer.json PSR-4 mapping
- bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php)
- tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer)
- 26 architecture contract tests
- enforcement-policy, guard-catalog, quality-gates
- all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/)
- bin/qa-extended.sh search paths
- .claude/settings.local.json permission paths

Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner →
Executor → Code Review (4 findings fixed) → Security Review →
Acceptance Test → Finalizer)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/Repository/Security/RateLimitRepository.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace MintyPHP\Repository\Security;
+
+use MintyPHP\DB;
+
+/** Persists rate limit counters with hit tracking, window expiry, and block duration. */
+class RateLimitRepository implements RateLimitRepositoryInterface
+{
+    public function findByScopeAndHash(string $scope, string $subjectHash): ?array
+    {
+        $row = DB::selectOne(
+            'select id, scope, subject_hash, hits, window_started_at, blocked_until, created, modified from request_rate_limits where scope = ? and subject_hash = ? limit 1',
+            $scope,
+            $subjectHash
+        );
+        if (!$row || !isset($row['request_rate_limits']) || !is_array($row['request_rate_limits'])) {
+            return null;
+        }
+        return $row['request_rate_limits'];
+    }
+
+    public function create(
+        string $scope,
+        string $subjectHash,
+        int $hits,
+        string $windowStartedAt,
+        ?string $blockedUntil
+    ): bool {
+        $result = DB::insert(
+            'insert into request_rate_limits (scope, subject_hash, hits, window_started_at, blocked_until, created) values (?,?,?,?,?,NOW())',
+            $scope,
+            $subjectHash,
+            (string) max(0, $hits),
+            $windowStartedAt,
+            $blockedUntil
+        );
+        return $result !== false;
+    }
+
+    public function updateStateById(
+        int $id,
+        int $hits,
+        string $windowStartedAt,
+        ?string $blockedUntil
+    ): bool {
+        if ($id <= 0) {
+            return false;
+        }
+
+        $result = DB::update(
+            'update request_rate_limits set hits = ?, window_started_at = ?, blocked_until = ? where id = ?',
+            (string) max(0, $hits),
+            $windowStartedAt,
+            $blockedUntil,
+            (string) $id
+        );
+        return $result !== false;
+    }
+
+    public function deleteByScopeAndHash(string $scope, string $subjectHash): bool
+    {
+        $result = DB::delete(
+            'delete from request_rate_limits where scope = ? and subject_hash = ?',
+            $scope,
+            $subjectHash
+        );
+        return $result !== false;
+    }
+}