refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root
immediately communicates which code is core platform and which lives
in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the
Composer PSR-4 path mapping moves from lib/ to core/.

Module-internal lib/ directories (modules/*/lib/) are untouched.

Updated across the full stack:
- composer.json PSR-4 mapping
- bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php)
- tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer)
- 26 architecture contract tests
- enforcement-policy, guard-catalog, quality-gates
- all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/)
- bin/qa-extended.sh search paths
- .claude/settings.local.json permission paths

Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner →
Executor → Code Review (4 findings fixed) → Security Review →
Acceptance Test → Finalizer)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/Service/Audit/UserLifecycleAuditInterface.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace MintyPHP\Service\Audit;
+
+/**
+ * Core-side contract for recording user lifecycle audit events (deactivation, deletion, restore).
+ *
+ * Implemented by the audit module's UserLifecycleAuditService when active.
+ * Falls back to NullUserLifecycleAudit (no-op) when the audit module is disabled.
+ */
+interface UserLifecycleAuditInterface
+{
+    /**
+     * @param array<string, mixed> $policy
+     * @param array<string, mixed> $targetUser
+     */
+    public function logDeactivate(
+        string $runUuid,
+        string $triggerType,
+        array $policy,
+        ?int $actorUserId,
+        array $targetUser,
+        string $status = 'success',
+        ?string $reasonCode = null
+    ): bool;
+
+    /**
+     * @param array<string, mixed> $policy
+     * @param array<string, mixed> $targetUser
+     */
+    public function logDeleteWithSnapshot(
+        string $runUuid,
+        string $triggerType,
+        array $policy,
+        ?int $actorUserId,
+        array $targetUser
+    ): int|false;
+
+    /**
+     * @param array<string, mixed> $policy
+     * @param array<string, mixed> $targetUser
+     */
+    public function logDeleteFailure(
+        string $runUuid,
+        string $triggerType,
+        array $policy,
+        ?int $actorUserId,
+        array $targetUser,
+        string $reasonCode
+    ): bool;
+
+    /**
+     * @param array<string, mixed> $policy
+     * @param array<string, mixed> $targetUser
+     */
+    public function logRestore(
+        string $runUuid,
+        string $triggerType,
+        array $policy,
+        ?int $actorUserId,
+        array $targetUser,
+        string $status = 'success',
+        ?string $reasonCode = null
+    ): bool;
+
+    public function markDeleteEventRestored(int $auditId, int $restoredByUserId, int $restoredUserId): bool;
+
+    public function updateStatus(int $id, string $status, ?string $reasonCode = null): bool;
+
+    public function findDeleteEventForRestore(int $id, bool $forUpdate = false): ?array;
+
+    public function decryptSnapshot(array $event): ?array;
+}