feat: extract bookmarks as standalone module with MintyPHP\Module\Bookmarks namespace

Moves bookmarks from core hardcoding into modules/bookmarks/ as a
fully self-contained module, following the same pattern as addressbook.

Module contributions via platform slots:
- aside.tab_panel: bookmark sidebar panel
- topbar.right_item: bookmark toggle button
- layout.body_end_template: bookmark/group dialogs
- layout.head_style: bookmark CSS (form + sidebar)
- runtime.component: bookmark-save and bookmark-panel (phase: late)
- search.resource_item: bookmarks in global search (user-scoped via {{userId}})

Backend fully in module namespace (MintyPHP\Module\Bookmarks\*):
- Service: BookmarkService, BookmarkServicesFactory, BookmarkRepositoryFactory
- Repository: BookmarkRepository, BookmarkGroupRepository, BookmarkNavigationRepository
- Support: BookmarkUrlNormalizer
- Providers: BookmarksSessionProvider, BookmarksLayoutProvider, BookmarksSearchProvider

Core cleanup:
- Removed all bookmark-specific markup from core templates
- Removed core DI registrations for bookmark services
- Removed core bookmark pages, JS, CSS
- AuthSessionTenantContextService delegates to module SessionProvider

Architecture guards:
- NoBookmarksHardcodingTest: verifies zero bookmark references in core
- testModuleClassesUseModuleNamespace: prevents core namespace leakage

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/bookmarks/pages/bookmarks/delete-data().php

@@ -0,0 +1,48 @@
+<?php
+
+use MintyPHP\Http\SessionStoreInterface;
+use MintyPHP\Router;
+use MintyPHP\Module\Bookmarks\Service\BookmarkService;
+use MintyPHP\Session;
+use MintyPHP\Support\Guard;
+
+Guard::requireLogin();
+
+if (requestInput()->method() !== 'POST') {
+    http_response_code(405);
+    Router::json(['ok' => false, 'error' => 'method_not_allowed']);
+    return;
+}
+
+if (!Session::checkCsrfToken()) {
+    http_response_code(403);
+    Router::json(['ok' => false, 'error' => 'csrf']);
+    return;
+}
+
+$session = app(SessionStoreInterface::class)->all();
+$userId = (int) ($session['user']['id'] ?? 0);
+if ($userId <= 0) {
+    http_response_code(401);
+    Router::json(['ok' => false, 'error' => 'unauthorized']);
+    return;
+}
+
+$bookmarkId = (int) requestInput()->body('id');
+if ($bookmarkId <= 0) {
+    http_response_code(400);
+    Router::json(['ok' => false, 'error' => 'invalid_bookmark_id']);
+    return;
+}
+
+$service = app(BookmarkService::class);
+$deleted = $service->deleteBookmark($userId, $bookmarkId);
+
+if ($deleted) {
+    app(SessionStoreInterface::class)->set('module.bookmarks.grouped', $service->listGroupedForUser($userId));
+    Router::json(['ok' => true]);
+    return;
+}
+
+http_response_code(404);
+Router::json(['ok' => false, 'error' => 'not_found']);

modules/bookmarks/pages/bookmarks/group-delete-data().php

@@ -0,0 +1,48 @@
+<?php
+
+use MintyPHP\Http\SessionStoreInterface;
+use MintyPHP\Router;
+use MintyPHP\Module\Bookmarks\Service\BookmarkService;
+use MintyPHP\Session;
+use MintyPHP\Support\Guard;
+
+Guard::requireLogin();
+
+if (requestInput()->method() !== 'POST') {
+    http_response_code(405);
+    Router::json(['ok' => false, 'error' => 'method_not_allowed']);
+    return;
+}
+
+if (!Session::checkCsrfToken()) {
+    http_response_code(403);
+    Router::json(['ok' => false, 'error' => 'csrf']);
+    return;
+}
+
+$session = app(SessionStoreInterface::class)->all();
+$userId = (int) ($session['user']['id'] ?? 0);
+if ($userId <= 0) {
+    http_response_code(401);
+    Router::json(['ok' => false, 'error' => 'unauthorized']);
+    return;
+}
+
+$groupId = (int) requestInput()->body('id');
+if ($groupId <= 0) {
+    http_response_code(400);
+    Router::json(['ok' => false, 'error' => 'invalid_group_id']);
+    return;
+}
+
+$service = app(BookmarkService::class);
+$deleted = $service->deleteGroup($userId, $groupId);
+
+if ($deleted) {
+    app(SessionStoreInterface::class)->set('module.bookmarks.grouped', $service->listGroupedForUser($userId));
+    Router::json(['ok' => true]);
+    return;
+}
+
+http_response_code(404);
+Router::json(['ok' => false, 'error' => 'not_found']);

modules/bookmarks/pages/bookmarks/group-save-data().php

@@ -0,0 +1,45 @@
+<?php
+
+use MintyPHP\Http\SessionStoreInterface;
+use MintyPHP\Router;
+use MintyPHP\Module\Bookmarks\Service\BookmarkService;
+use MintyPHP\Session;
+use MintyPHP\Support\Guard;
+
+Guard::requireLogin();
+
+if (requestInput()->method() !== 'POST') {
+    http_response_code(405);
+    Router::json(['ok' => false, 'error' => 'method_not_allowed']);
+    return;
+}
+
+if (!Session::checkCsrfToken()) {
+    http_response_code(403);
+    Router::json(['ok' => false, 'error' => 'csrf']);
+    return;
+}
+
+$session = app(SessionStoreInterface::class)->all();
+$userId = (int) ($session['user']['id'] ?? 0);
+if ($userId <= 0) {
+    http_response_code(401);
+    Router::json(['ok' => false, 'error' => 'unauthorized']);
+    return;
+}
+
+$name = trim((string) requestInput()->body('name'));
+$icon = trim((string) requestInput()->body('icon'));
+$groupId = requestInput()->body('id');
+$groupId = ($groupId !== null && $groupId !== '') ? (int) $groupId : null;
+
+$service = app(BookmarkService::class);
+$result = $service->saveGroup($userId, $name, $icon, $groupId);
+
+if ($result['ok']) {
+    app(SessionStoreInterface::class)->set('module.bookmarks.grouped', $service->listGroupedForUser($userId));
+} else {
+    http_response_code(400);
+}
+
+Router::json($result);

modules/bookmarks/pages/bookmarks/reorder-data().php

@@ -0,0 +1,110 @@
+<?php
+
+use MintyPHP\Http\SessionStoreInterface;
+use MintyPHP\Router;
+use MintyPHP\Module\Bookmarks\Service\BookmarkService;
+use MintyPHP\Session;
+use MintyPHP\Support\Guard;
+
+Guard::requireLogin();
+
+if (requestInput()->method() !== 'POST') {
+    http_response_code(405);
+    Router::json(['ok' => false, 'error' => 'method_not_allowed']);
+    return;
+}
+
+if (!Session::checkCsrfToken()) {
+    http_response_code(403);
+    Router::json(['ok' => false, 'error' => 'csrf']);
+    return;
+}
+
+$session = app(SessionStoreInterface::class)->all();
+$userId = (int) ($session['user']['id'] ?? 0);
+if ($userId <= 0) {
+    http_response_code(401);
+    Router::json(['ok' => false, 'error' => 'unauthorized']);
+    return;
+}
+
+$type = trim((string) requestInput()->body('type'));
+$rawItems = requestInput()->body('items');
+
+$items = is_array($rawItems) ? $rawItems : (is_string($rawItems) ? json_decode($rawItems, true) : []);
+if (!is_array($items) || $items === []) {
+    http_response_code(400);
+    Router::json(['ok' => false, 'error' => 'invalid_items']);
+    return;
+}
+
+$service = app(BookmarkService::class);
+
+if ($type === 'root') {
+    $rootPairs = [];
+    $seenRootIds = [];
+    $seenSortOrders = [];
+
+    foreach ($items as $item) {
+        if (!is_array($item)) {
+            http_response_code(400);
+            Router::json(['ok' => false, 'error' => 'invalid_items']);
+            return;
+        }
+        $kind = trim((string) ($item['kind'] ?? ''));
+        $id = (int) ($item['id'] ?? 0);
+        $sortOrder = (int) ($item['sort_order'] ?? 0);
+        if (($kind !== 'group' && $kind !== 'bookmark') || $id <= 0 || $sortOrder <= 0) {
+            http_response_code(400);
+            Router::json(['ok' => false, 'error' => 'invalid_items']);
+            return;
+        }
+        $dedupeKey = $kind . ':' . $id;
+        if (isset($seenRootIds[$dedupeKey]) || isset($seenSortOrders[$sortOrder])) {
+            http_response_code(400);
+            Router::json(['ok' => false, 'error' => 'invalid_items']);
+            return;
+        }
+        $seenRootIds[$dedupeKey] = true;
+        $seenSortOrders[$sortOrder] = true;
+        $rootPairs[] = ['kind' => $kind, 'id' => $id, 'sort_order' => $sortOrder];
+    }
+
+    $result = $service->reorderRootFromItems($userId, $rootPairs);
+} else {
+    $pairs = [];
+    $seenIds = [];
+
+    foreach ($items as $item) {
+        if (!is_array($item)) {
+            http_response_code(400);
+            Router::json(['ok' => false, 'error' => 'invalid_items']);
+            return;
+        }
+        $id = (int) ($item['id'] ?? 0);
+        $sortOrder = (int) ($item['sort_order'] ?? 0);
+        if ($id <= 0 || $sortOrder <= 0) {
+            http_response_code(400);
+            Router::json(['ok' => false, 'error' => 'invalid_items']);
+            return;
+        }
+        if (isset($seenIds[$id])) {
+            http_response_code(400);
+            Router::json(['ok' => false, 'error' => 'invalid_items']);
+            return;
+        }
+        $seenIds[$id] = true;
+        $pairs[] = ['id' => $id, 'sort_order' => $sortOrder];
+    }
+
+    $result = $service->reorderFromItems($userId, $type, $pairs);
+}
+
+if ($result['ok']) {
+    app(SessionStoreInterface::class)->set('module.bookmarks.grouped', $service->listGroupedForUser($userId));
+    Router::json(['ok' => true]);
+    return;
+}
+
+http_response_code(400);
+Router::json($result);

modules/bookmarks/pages/bookmarks/save-data().php

@@ -0,0 +1,45 @@
+<?php
+
+use MintyPHP\Http\SessionStoreInterface;
+use MintyPHP\Router;
+use MintyPHP\Module\Bookmarks\Service\BookmarkService;
+use MintyPHP\Session;
+use MintyPHP\Support\Guard;
+
+Guard::requireLogin();
+
+if (requestInput()->method() !== 'POST') {
+    http_response_code(405);
+    Router::json(['ok' => false, 'error' => 'method_not_allowed']);
+    return;
+}
+
+if (!Session::checkCsrfToken()) {
+    http_response_code(403);
+    Router::json(['ok' => false, 'error' => 'csrf']);
+    return;
+}
+
+$session = app(SessionStoreInterface::class)->all();
+$userId = (int) ($session['user']['id'] ?? 0);
+if ($userId <= 0) {
+    http_response_code(401);
+    Router::json(['ok' => false, 'error' => 'unauthorized']);
+    return;
+}
+
+$name = trim((string) requestInput()->body('name'));
+$url = trim((string) requestInput()->body('url'));
+$groupId = requestInput()->body('group_id');
+$groupId = ($groupId !== null && $groupId !== '') ? (int) $groupId : null;
+
+$service = app(BookmarkService::class);
+$result = $service->saveBookmark($userId, $name, $url, $groupId);
+
+if ($result['ok']) {
+    app(SessionStoreInterface::class)->set('module.bookmarks.grouped', $service->listGroupedForUser($userId));
+} else {
+    http_response_code(400);
+}
+
+Router::json($result);

modules/bookmarks/pages/bookmarks/update-data().php

@@ -0,0 +1,55 @@
+<?php
+
+use MintyPHP\Http\SessionStoreInterface;
+use MintyPHP\Router;
+use MintyPHP\Module\Bookmarks\Service\BookmarkService;
+use MintyPHP\Session;
+use MintyPHP\Support\Guard;
+
+Guard::requireLogin();
+
+if (requestInput()->method() !== 'POST') {
+    http_response_code(405);
+    Router::json(['ok' => false, 'error' => 'method_not_allowed']);
+    return;
+}
+
+if (!Session::checkCsrfToken()) {
+    http_response_code(403);
+    Router::json(['ok' => false, 'error' => 'csrf']);
+    return;
+}
+
+$session = app(SessionStoreInterface::class)->all();
+$userId = (int) ($session['user']['id'] ?? 0);
+if ($userId <= 0) {
+    http_response_code(401);
+    Router::json(['ok' => false, 'error' => 'unauthorized']);
+    return;
+}
+
+$bookmarkId = (int) requestInput()->body('id');
+if ($bookmarkId <= 0) {
+    http_response_code(400);
+    Router::json(['ok' => false, 'error' => 'invalid_bookmark_id']);
+    return;
+}
+
+$data = [];
+if (requestInput()->body('name') !== null) {
+    $data['name'] = (string) requestInput()->body('name');
+}
+if (requestInput()->body('group_id') !== null) {
+    $data['group_id'] = requestInput()->body('group_id');
+}
+
+$service = app(BookmarkService::class);
+$result = $service->updateBookmark($userId, $bookmarkId, $data);
+
+if ($result['ok']) {
+    app(SessionStoreInterface::class)->set('module.bookmarks.grouped', $service->listGroupedForUser($userId));
+} else {
+    http_response_code(400);
+}
+
+Router::json($result);