feat: introduce module system and extract address book as first module (MODULAR-MONOLITH-V1-001)

Add a module kernel (ModuleManifest, ModuleRegistry) that allows modules to
contribute routes, UI slots, search providers, layout context, session
lifecycle, and permissions. Modules are activated via config/modules.php or
APP_ENABLED_MODULES env variable. Conflicts (duplicate routes, permissions,
slot keys) cause a fail-fast with a clear error message.

Extract the address book from hardcoded Core integration points into the
first module (modules/addressbook/). The module provides:
- Aside icon-bar tab + People panel via UI slot system
- Global search resource via AddressBookSearchProvider
- Layout context data via AddressBookLayoutProvider
- Session lifecycle via AddressBookSessionProvider

Core cleanup removes address-book hardcodings from SearchSqlResourceProvider,
SearchUiMetaProvider, SearchItemMapperProvider, appBuildLayoutNavContext(),
and the aside templates. Permissions (ADDRESS_BOOK_VIEW) and business logic
(AddressBookService) remain in Core as they gate general user visibility.

Includes 38 new tests (894 total), PHPStan level 5 clean, and architecture
tests verifying zero hardcoded address-book references in search/templates.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/index.php

@@ -198,7 +198,16 @@ if ($requestedLocale === '' && !$isAssetRequest && !$isApiRequest) {
 }
 
 // Guard: restrict non-public pages to logged-in users
-$accessControl = new AccessControl();
+// Merge core public paths with module-contributed public paths.
+$modulePublicPaths = [];
+if (app(\MintyPHP\App\Module\ModuleRegistry::class) instanceof \MintyPHP\App\Module\ModuleRegistry) {
+    $modulePublicPaths = app(\MintyPHP\App\Module\ModuleRegistry::class)->getPublicPaths();
+}
+$allPublicPaths = array_values(array_unique(array_merge(
+    defined('APP_PUBLIC_PATHS') ? APP_PUBLIC_PATHS : [],
+    $modulePublicPaths
+)));
+$accessControl = new AccessControl($allPublicPaths);
 $accessControl->requireAuthOrRedirect($pathWithoutLocale, !empty($_SESSION['user']['id']));
 
 // Analyze the PHP code