refactor(cli)!: hard-cut legacy scripts and standardize console runtime

- remove legacy bin/module-*.php and bin/doctor.php entry scripts

- move module/doctor execution into class-based runners under lib/Console

- add stable JSON output for doctor and module:sync

- introduce bin/dev for init/up/down/logs/console/qa workflow

- update DI wiring, phpstan scan config, tests, and docs to new CLI contract

CLAUDE.md

@@ -90,7 +90,7 @@ db/updates/             # Idempotent SQL update scripts for existing installs
 tests/                  # PHPUnit tests (namespace MintyPHP\Tests\)
 docs/                   # German-language documentation (Markdown)
 i18n/                   # Translation files (de, en)
-bin/                    # CLI entry point (bin/console) + legacy scripts + shell tools
+bin/                    # CLI entry points (bin/console, bin/dev) + shell tools
 docker/                 # Dockerfiles, Nginx configs, PHP configs
 .agents/                # Agent workflow system (contracts, prompts, checks, skills, runs)
 ```
@@ -118,7 +118,7 @@ docker/                 # Dockerfiles, Nginx configs, PHP configs
 - **UI integration:** Only via platform slots (`aside.tab_panel`, `topbar.right_item`, `layout.head_style`, `runtime.component`, etc.) — no core template hardcoding
 - **Session keys:** Prefixed with `module.<id>.*`
 - **Activation:** `config/modules.php` or `APP_ENABLED_MODULES` env override
-- **Runtime sync:** `php bin/module-runtime-sync.php` after any module/manifest change (builds page symlinks, syncs permissions, publishes assets)
+- **Runtime sync:** `php bin/console module:sync` after any module/manifest change (builds page symlinks, syncs permissions, publishes assets)
 - **Fingerprint guard:** `web/index.php` validates runtime state matches active modules; fails fast if stale
 - **API isolation:** API requests (`api/` prefix) skip session/auth/cookie flows entirely; modules using API endpoints rely on `ApiBootstrap.php`
 - **Cross-module coupling:** Modules may depend on other modules but MUST declare `requires: [<module-id>]` in their manifest. Undeclared cross-module imports are forbidden. Prefer loose coupling via events and providers over direct service injection