refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root
immediately communicates which code is core platform and which lives
in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the
Composer PSR-4 path mapping moves from lib/ to core/.

Module-internal lib/ directories (modules/*/lib/) are untouched.

Updated across the full stack:
- composer.json PSR-4 mapping
- bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php)
- tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer)
- 26 architecture contract tests
- enforcement-policy, guard-catalog, quality-gates
- all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/)
- bin/qa-extended.sh search paths
- .claude/settings.local.json permission paths

Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner →
Executor → Code Review (4 findings fixed) → Security Review →
Acceptance Test → Finalizer)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/explanation-session-management.md

@@ -85,7 +85,7 @@ Loesung: Alle 5 Minuten prueft ein Intervall ob seit dem letzten Sync Interaktio
 
 ## Remember-Token
 
-Quelle: `lib/Service/Auth/RememberMeService.php`
+Quelle: `core/Service/Auth/RememberMeService.php`
 
 ### Token-Struktur
 
@@ -117,7 +117,7 @@ Token-Rotation bei jedem Auto-Login begrenzt das Fenster bei Cookie-Diebstahl.
 
 ### Rate Limiting (Remember-Token)
 
-Quelle: `lib/Service/Auth/RememberMeRateLimiter.php`
+Quelle: `core/Service/Auth/RememberMeRateLimiter.php`
 
 - Storage: Memcached (`Cache::add` + `Cache::increment`)
 - Limit: 5 Fehlversuche pro IP in 15 Minuten
@@ -166,10 +166,10 @@ Das Secure-Flag wird automatisch anhand des Protokolls gesetzt (`RequestRuntime:
 | Komponente | Pfad |
 |------------|------|
 | Timeout-Pruefung | `web/index.php` |
-| AuthService | `lib/Service/Auth/AuthService.php` |
-| RememberMeService | `lib/Service/Auth/RememberMeService.php` |
-| RememberMeRateLimiter | `lib/Service/Auth/RememberMeRateLimiter.php` |
-| Session-Settings | `lib/Service/Settings/SettingsSessionGateway.php` |
+| AuthService | `core/Service/Auth/AuthService.php` |
+| RememberMeService | `core/Service/Auth/RememberMeService.php` |
+| RememberMeRateLimiter | `core/Service/Auth/RememberMeRateLimiter.php` |
+| Session-Settings | `core/Service/Settings/SettingsSessionGateway.php` |
 | Frontend-Warning | `web/js/components/app-session-warning.js` |
 | Session-Ping | `pages/admin/session-ping/data().php` |
 | Login-Action | `pages/auth/login().php` |