feat: introduce module system and extract address book as first module (MODULAR-MONOLITH-V1-001)

Add a module kernel (ModuleManifest, ModuleRegistry) that allows modules to
contribute routes, UI slots, search providers, layout context, session
lifecycle, and permissions. Modules are activated via config/modules.php or
APP_ENABLED_MODULES env variable. Conflicts (duplicate routes, permissions,
slot keys) cause a fail-fast with a clear error message.

Extract the address book from hardcoded Core integration points into the
first module (modules/addressbook/). The module provides:
- Aside icon-bar tab + People panel via UI slot system
- Global search resource via AddressBookSearchProvider
- Layout context data via AddressBookLayoutProvider
- Session lifecycle via AddressBookSessionProvider

Core cleanup removes address-book hardcodings from SearchSqlResourceProvider,
SearchUiMetaProvider, SearchItemMapperProvider, appBuildLayoutNavContext(),
and the aside templates. Permissions (ADDRESS_BOOK_VIEW) and business logic
(AddressBookService) remain in Core as they gate general user visibility.

Includes 38 new tests (894 total), PHPStan level 5 clean, and architecture
tests verifying zero hardcoded address-book references in search/templates.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/App/Module/Contracts/LayoutContextProvider.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+use MintyPHP\App\AppContainer;
+
+/**
+ * Provides module-specific data for the layout navigation context.
+ *
+ * Called from appBuildLayoutNavContext() after Core data assembly.
+ * Return value is merged into the $layoutNav array passed to templates.
+ */
+interface LayoutContextProvider
+{
+    /**
+     * @param array<string, mixed> $session Current session data
+     * @return array<string, mixed> Key-value pairs to merge into $layoutNav
+     */
+    public function provide(array $session, AppContainer $container): array;
+}

lib/App/Module/Contracts/SearchResourceProvider.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+/**
+ * Provides search resources contributed by a module.
+ *
+ * Each provider returns a list of search resources (with SQL for count/preview/result),
+ * maps result rows to display items, and provides list URLs for deep-linking.
+ */
+interface SearchResourceProvider
+{
+    /**
+     * Return search resource definitions.
+     *
+     * @return array<string, array{
+     *     label: string,
+     *     permission: string,
+     *     count_sql: string,
+     *     preview_sql: string,
+     *     result_sql: string,
+     *     tenant_filter?: string
+     * }>
+     */
+    public function resources(): array;
+
+    /**
+     * Map a raw result row to a display-ready item.
+     *
+     * @param array<string, mixed> $row
+     * @return array{title: string, subtitle?: string, url: string, icon?: string}|null
+     */
+    public function mapResultItem(string $resourceKey, array $row): ?array;
+
+    /**
+     * Return the list URL for the given resource key and encoded search term.
+     */
+    public function listUrl(string $resourceKey, string $encodedSearch): string;
+}

lib/App/Module/Contracts/SessionProvider.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace MintyPHP\App\Module\Contracts;
+
+use MintyPHP\App\AppContainer;
+
+/**
+ * Populates module-specific session data after login and cleans up on logout.
+ *
+ * Called from the login flow after successful authentication. When a module is
+ * deactivated, its provider is not called — session keys are simply not set.
+ */
+interface SessionProvider
+{
+    /**
+     * Populate session keys with module-specific data after successful login.
+     *
+     * @param array<string, mixed> $user The authenticated user record
+     */
+    public function populate(array $user, AppContainer $container): void;
+
+    /**
+     * Remove session keys owned by this module (called on logout).
+     */
+    public function clear(): void;
+}