refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root
immediately communicates which code is core platform and which lives
in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the
Composer PSR-4 path mapping moves from lib/ to core/.

Module-internal lib/ directories (modules/*/lib/) are untouched.

Updated across the full stack:
- composer.json PSR-4 mapping
- bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php)
- tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer)
- 26 architecture contract tests
- enforcement-policy, guard-catalog, quality-gates
- all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/)
- bin/qa-extended.sh search paths
- .claude/settings.local.json permission paths

Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner →
Executor → Code Review (4 findings fixed) → Security Review →
Acceptance Test → Finalizer)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/Service/Auth/LdapConnectionGateway.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace MintyPHP\Service\Auth;
+
+/**
+ * Thin wrapper around PHP ldap_* functions for testability.
+ *
+ * Every public method maps 1:1 to a native ldap_* call.
+ * In tests, this gateway is replaced with a mock.
+ */
+class LdapConnectionGateway
+{
+    /** @return \LDAP\Connection|false */
+    public function connect(string $uri): \LDAP\Connection|false
+    {
+        return ldap_connect($uri);
+    }
+
+    public function setOption(\LDAP\Connection $conn, int $option, mixed $value): bool
+    {
+        return ldap_set_option($conn, $option, $value);
+    }
+
+    public function startTls(\LDAP\Connection $conn): bool
+    {
+        return ldap_start_tls($conn);
+    }
+
+    public function bind(\LDAP\Connection $conn, ?string $dn = null, ?string $password = null): bool
+    {
+        return @ldap_bind($conn, $dn, $password);
+    }
+
+    /**
+     * @return mixed LDAP\Result on success, false on failure.
+     */
+    public function search(\LDAP\Connection $conn, string $baseDn, string $filter, array $attributes = [], int $scope = 0): mixed
+    {
+        if ($scope === 1) {
+            return @ldap_list($conn, $baseDn, $filter, $attributes);
+        }
+        return @ldap_search($conn, $baseDn, $filter, $attributes);
+    }
+
+    public function getEntries(\LDAP\Connection $conn, mixed $result): array|false
+    {
+        if (!$result instanceof \LDAP\Result) {
+            return false;
+        }
+
+        return ldap_get_entries($conn, $result);
+    }
+
+    public function escape(string $value, string $ignore = '', int $flags = 0): string
+    {
+        return ldap_escape($value, $ignore, $flags);
+    }
+
+    public function errno(\LDAP\Connection $conn): int
+    {
+        return ldap_errno($conn);
+    }
+
+    public function error(\LDAP\Connection $conn): string
+    {
+        return ldap_error($conn);
+    }
+
+    public function unbind(\LDAP\Connection $conn): bool
+    {
+        return @ldap_unbind($conn);
+    }
+}