refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root
immediately communicates which code is core platform and which lives
in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the
Composer PSR-4 path mapping moves from lib/ to core/.

Module-internal lib/ directories (modules/*/lib/) are untouched.

Updated across the full stack:
- composer.json PSR-4 mapping
- bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php)
- tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer)
- 26 architecture contract tests
- enforcement-policy, guard-catalog, quality-gates
- all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/)
- bin/qa-extended.sh search paths
- .claude/settings.local.json permission paths

Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner →
Executor → Code Review (4 findings fixed) → Security Review →
Acceptance Test → Finalizer)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/Service/Settings/SettingsMicrosoftGateway.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace MintyPHP\Service\Settings;
+
+class SettingsMicrosoftGateway
+{
+    public function __construct(
+        private readonly SettingsMetadataGateway $settingsMetadataGateway,
+        private readonly SettingsCryptoGatewayInterface $settingsCryptoGateway
+    ) {
+    }
+
+    public function getMicrosoftSharedClientId(): ?string
+    {
+        $value = $this->settingsMetadataGateway->getValue(SettingKeys::MICROSOFT_SHARED_CLIENT_ID_KEY);
+        $value = $value !== null ? trim($value) : '';
+        return $value !== '' ? $value : null;
+    }
+
+    public function setMicrosoftSharedClientId(?string $clientId, ?string $description = null): bool
+    {
+        $value = $clientId !== null ? trim($clientId) : '';
+        if ($value === '') {
+            $value = null;
+        }
+
+        $desc = $description ?? 'setting.microsoft_shared_client_id';
+        return $this->settingsMetadataGateway->set(SettingKeys::MICROSOFT_SHARED_CLIENT_ID_KEY, $value, $desc);
+    }
+
+    public function getMicrosoftSharedClientSecretEncrypted(): ?string
+    {
+        $value = $this->settingsMetadataGateway->getValue(SettingKeys::MICROSOFT_SHARED_CLIENT_SECRET_ENC_KEY);
+        $value = $value !== null ? trim($value) : '';
+        return $value !== '' ? $value : null;
+    }
+
+    public function getMicrosoftSharedClientSecret(): ?string
+    {
+        $encrypted = $this->getMicrosoftSharedClientSecretEncrypted();
+        if ($encrypted === null) {
+            return null;
+        }
+
+        try {
+            $decrypted = $this->settingsCryptoGateway->decryptString($encrypted);
+        } catch (\Throwable) {
+            return null;
+        }
+
+        $decrypted = trim($decrypted);
+        return $decrypted !== '' ? $decrypted : null;
+    }
+
+    public function setMicrosoftSharedClientSecret(?string $secret, ?string $description = null): bool
+    {
+        $value = $secret !== null ? trim($secret) : '';
+        if ($value === '') {
+            return $this->settingsMetadataGateway->set(
+                SettingKeys::MICROSOFT_SHARED_CLIENT_SECRET_ENC_KEY,
+                null,
+                $description ?? 'setting.microsoft_shared_client_secret_enc'
+            );
+        }
+
+        try {
+            $encrypted = $this->settingsCryptoGateway->encryptString($value);
+        } catch (\Throwable) {
+            return false;
+        }
+
+        $desc = $description ?? 'setting.microsoft_shared_client_secret_enc';
+        return $this->settingsMetadataGateway->set(SettingKeys::MICROSOFT_SHARED_CLIENT_SECRET_ENC_KEY, $encrypted, $desc);
+    }
+
+    public function getMicrosoftAuthority(): string
+    {
+        $value = $this->settingsMetadataGateway->getValue(SettingKeys::MICROSOFT_AUTHORITY_KEY);
+        $value = trim((string) ($value ?? ''));
+        if ($value === '') {
+            return 'https://login.microsoftonline.com/common/v2.0';
+        }
+
+        return rtrim($value, '/');
+    }
+
+    public function setMicrosoftAuthority(?string $authority, ?string $description = null): bool
+    {
+        $value = trim((string) ($authority ?? ''));
+        if ($value === '') {
+            $value = 'https://login.microsoftonline.com/common/v2.0';
+        }
+        if (!preg_match('#^https://#i', $value)) {
+            return false;
+        }
+
+        $desc = $description ?? 'setting.microsoft_authority';
+        return $this->settingsMetadataGateway->set(SettingKeys::MICROSOFT_AUTHORITY_KEY, rtrim($value, '/'), $desc);
+    }
+}