feat(user-lifecycle): cockpit foundation — KPI row + aside quick actions

Phase 1 of the Stripe-style policy-cockpit redesign for the user-lifecycle
settings page. Pure server-rendering — no async, no JS components, no
sparklines yet (those land in later phases).

Adds a four-tile KPI row above the configuration form (Last run,
Deactivated/30d, Deleted/30d, Pending deletion/7d), populates the
previously empty aside with three quick actions (Run policy now,
Purge logs, Policy reference link), and surfaces a relative-time +
status hint under the existing Run-Now collapsible.

Module-isolation is preserved through a new read-side contract:

* core/Service/Audit/UserLifecycleAuditDashboardInterface — read-only
  pendant to the existing write-side UserLifecycleAuditInterface.
  Methods: lastRun(), summaryByAction(int days), countActionInWindow(...).
* core/Service/Audit/NullUserLifecycleAuditDashboard — fail-closed
  default when the audit module is disabled. KPI tiles 1-3 then
  render "—"; tile 4 (pending deletion) keeps working because it
  lives in the core domain.
* modules/audit/.../Service/UserLifecycleAuditDashboardService — the
  module's implementation; reads through the existing
  UserLifecycleAuditRepository (extended with three new aggregation
  queries: lastRun, countByActionStatusSinceTimestamp, countSinceTimestamp).
* AuditContainerRegistrar binds the interface to the module impl;
  registerContainer.php registers the Null fallback before module
  bindings, mirroring how the write-side audit interface is wired.

The new core service UserLifecyclePolicyDashboardService computes
the pending-deletion-window count from the users table directly
(no audit dependency) — defensive when both policy days are 0
(returns 0 rather than running an unbounded query).

New shared template partial templates/partials/app-kpi-row.phtml is
generic — accepts a $kpiTiles array of {label, count, icon, iconTone,
href, tooltip} and reuses the existing app-tile primitive. Other
settings pages can pick it up without ceremony.

Includes:
* PHPUnit tests for both new services (happy path + Null-fallback +
  policy-disabled edge cases).
* AuditModuleIsolationContractTest allowlist extended for the new
  interface and module service.
* 14 new translation keys in both default_de.json and default_en.json
  (i18n parity verified).

All six quality gates green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/App/Container/Registrars/UserRegistrar.php

@@ -7,6 +7,7 @@ use MintyPHP\App\Container\ContainerRegistrar;
 use MintyPHP\Repository\Access\UserRoleRepository;
 use MintyPHP\Repository\Org\UserDepartmentRepository;
 use MintyPHP\Repository\Tenant\UserTenantRepository;
+use MintyPHP\Repository\User\UserLifecyclePolicyDashboardRepository;
 use MintyPHP\Repository\User\UserReadRepository;
 use MintyPHP\Repository\User\UserWriteRepository;
 use MintyPHP\Service\Auth\TenantSsoService;
@@ -19,6 +20,7 @@ use MintyPHP\Service\User\UserApiWriteInputMapper;
 use MintyPHP\Service\User\UserAssignmentService;
 use MintyPHP\Service\User\UserAvatarService;
 use MintyPHP\Service\User\UserDirectoryGateway;
+use MintyPHP\Service\User\UserLifecyclePolicyDashboardService;
 use MintyPHP\Service\User\UserLifecycleRestoreService;
 use MintyPHP\Service\User\UserLifecycleService;
 use MintyPHP\Service\User\UserPasswordPolicyService;
@@ -61,6 +63,10 @@ final class UserRegistrar implements ContainerRegistrar
         $container->set(UserTenantRepository::class, static fn (AppContainer $c): UserTenantRepository => $c->get(UserRepositoryFactory::class)->createUserTenantRepository());
         $container->set(UserRoleRepository::class, static fn (AppContainer $c): UserRoleRepository => $c->get(UserRepositoryFactory::class)->createUserRoleRepository());
         $container->set(UserDepartmentRepository::class, static fn (AppContainer $c): UserDepartmentRepository => $c->get(UserRepositoryFactory::class)->createUserDepartmentRepository());
+        $container->set(UserLifecyclePolicyDashboardRepository::class, static fn (AppContainer $c): UserLifecyclePolicyDashboardRepository => $c->get(UserRepositoryFactory::class)->createUserLifecyclePolicyDashboardRepository());
+        $container->set(UserLifecyclePolicyDashboardService::class, static fn (AppContainer $c): UserLifecyclePolicyDashboardService => new UserLifecyclePolicyDashboardService(
+            $c->get(UserLifecyclePolicyDashboardRepository::class)
+        ));
         $container->set(UserProfileViewService::class, static fn (AppContainer $c): UserProfileViewService => new UserProfileViewService(
             $c->get(UserAccountService::class),
             $c->get(UserAssignmentService::class),

core/App/registerContainer.php

@@ -23,6 +23,8 @@ use MintyPHP\Service\Audit\NullAuditMetadataEnricher;
 use MintyPHP\Service\Audit\NullAuditRecorder;
 use MintyPHP\Service\Audit\NullImportAudit;
 use MintyPHP\Service\Audit\NullUserLifecycleAudit;
+use MintyPHP\Service\Audit\NullUserLifecycleAuditDashboard;
+use MintyPHP\Service\Audit\UserLifecycleAuditDashboardInterface;
 use MintyPHP\Service\Audit\UserLifecycleAuditInterface;
 
 $container = new AppContainer();
@@ -85,6 +87,9 @@ if (!$container->has(AuditRecorderInterface::class)) {
 if (!$container->has(UserLifecycleAuditInterface::class)) {
     $container->set(UserLifecycleAuditInterface::class, static fn (): UserLifecycleAuditInterface => new NullUserLifecycleAudit());
 }
+if (!$container->has(UserLifecycleAuditDashboardInterface::class)) {
+    $container->set(UserLifecycleAuditDashboardInterface::class, static fn (): UserLifecycleAuditDashboardInterface => new NullUserLifecycleAuditDashboard());
+}
 if (!$container->has(ImportAuditInterface::class)) {
     $container->set(ImportAuditInterface::class, static fn (): ImportAuditInterface => new NullImportAudit());
 }

core/Repository/User/UserLifecyclePolicyDashboardRepository.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace MintyPHP\Repository\User;
+
+use MintyPHP\DB;
+
+/**
+ * Counts users in the deletion window for the policy-dashboard tile. Time base is UTC, mirroring
+ * {@see UserReadRepository::listIdsForAutoDelete} for behavioural equivalence.
+ */
+class UserLifecyclePolicyDashboardRepository implements UserLifecyclePolicyDashboardRepositoryInterface
+{
+    public function countPendingDeletion(int $deleteDays, int $windowDays): int
+    {
+        if ($deleteDays <= 0 || $windowDays <= 0) {
+            return 0;
+        }
+        // Lower bound (deleteDays - windowDays) is clamped to 0 so a misconfigured tiny deleteDays
+        // value cannot produce a negative INTERVAL; the upper bound stays at deleteDays.
+        $lowerBoundDays = max(0, $deleteDays - $windowDays);
+
+        $value = DB::selectValue(
+            'select count(*)
+             from users
+             where active = 0
+               and active_changed_at is not null
+               and active_changed_at <= DATE_SUB(UTC_TIMESTAMP(), INTERVAL ? DAY)
+               and active_changed_at > DATE_SUB(UTC_TIMESTAMP(), INTERVAL ? DAY)',
+            (string) $lowerBoundDays,
+            (string) $deleteDays
+        );
+        return (int) ($value ?? 0);
+    }
+}

core/Repository/User/UserLifecyclePolicyDashboardRepositoryInterface.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace MintyPHP\Repository\User;
+
+/** Read-only contract for user lifecycle policy dashboard queries (KPI tiles). */
+interface UserLifecyclePolicyDashboardRepositoryInterface
+{
+    /**
+     * Count users currently deactivated whose deletion-due date falls inside the next $windowDays days.
+     *
+     * Counts users in the 7-day deletion window using active_changed_at as anchor; users without
+     * active_changed_at are excluded (cannot be scheduled for deletion).
+     */
+    public function countPendingDeletion(int $deleteDays, int $windowDays): int;
+}

core/Service/Audit/NullUserLifecycleAuditDashboard.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace MintyPHP\Service\Audit;
+
+/**
+ * No-op user lifecycle dashboard reader used when the audit module is disabled.
+ */
+final class NullUserLifecycleAuditDashboard implements UserLifecycleAuditDashboardInterface
+{
+    public function lastRun(): ?array
+    {
+        return null;
+    }
+
+    public function actionCountInWindow(string $action, int $days, string $status = 'success'): int
+    {
+        return 0;
+    }
+
+    public function summaryByAction(int $days, string $status = 'success'): array
+    {
+        return [];
+    }
+}

core/Service/Audit/UserLifecycleAuditDashboardInterface.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace MintyPHP\Service\Audit;
+
+/**
+ * Read-only counterpart to UserLifecycleAuditInterface for dashboard / KPI queries.
+ *
+ * Implemented by the audit module's UserLifecycleAuditDashboardService when active.
+ * Falls back to NullUserLifecycleAuditDashboard when the audit module is disabled.
+ */
+interface UserLifecycleAuditDashboardInterface
+{
+    /**
+     * Latest automatic (system-triggered) lifecycle run, or null when none recorded.
+     *
+     * @return array{created_at:string,status:string,action:string}|null
+     */
+    public function lastRun(): ?array;
+
+    /**
+     * Count successful (or status-filtered) audit-log events for a single action within the last $days.
+     */
+    public function actionCountInWindow(string $action, int $days, string $status = 'success'): int;
+
+    /**
+     * Aggregated count per action within the last $days, filtered by status.
+     *
+     * @return array<string, int>
+     */
+    public function summaryByAction(int $days, string $status = 'success'): array;
+}

core/Service/User/UserLifecyclePolicyDashboardService.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace MintyPHP\Service\User;
+
+use MintyPHP\Repository\User\UserLifecyclePolicyDashboardRepositoryInterface;
+
+/**
+ * Computes the "Pending deletion" KPI for the user lifecycle settings dashboard.
+ *
+ * If either policy threshold (deactivate / delete days) is disabled, the service short-circuits
+ * to 0 without issuing a database query.
+ *
+ * @api
+ */
+final class UserLifecyclePolicyDashboardService
+{
+    public function __construct(
+        private readonly UserLifecyclePolicyDashboardRepositoryInterface $userLifecyclePolicyDashboardRepository
+    ) {
+    }
+
+    public function pendingDeletionCount(int $deactivateDays, int $deleteDays, int $windowDays = 7): int
+    {
+        if ($deactivateDays <= 0 || $deleteDays <= 0 || $windowDays <= 0) {
+            return 0;
+        }
+        return $this->userLifecyclePolicyDashboardRepository->countPendingDeletion($deleteDays, $windowDays);
+    }
+}

core/Service/User/UserRepositoryFactory.php

@@ -8,6 +8,8 @@ use MintyPHP\Repository\Org\UserDepartmentRepository;
 use MintyPHP\Repository\Org\UserDepartmentRepositoryInterface;
 use MintyPHP\Repository\Tenant\UserTenantRepository;
 use MintyPHP\Repository\Tenant\UserTenantRepositoryInterface;
+use MintyPHP\Repository\User\UserLifecyclePolicyDashboardRepository;
+use MintyPHP\Repository\User\UserLifecyclePolicyDashboardRepositoryInterface;
 use MintyPHP\Repository\User\UserListQueryRepository;
 use MintyPHP\Repository\User\UserListQueryRepositoryInterface;
 use MintyPHP\Repository\User\UserReadRepository;
@@ -23,6 +25,7 @@ class UserRepositoryFactory
     private ?UserTenantRepository $userTenantRepository = null;
     private ?UserRoleRepository $userRoleRepository = null;
     private ?UserDepartmentRepository $userDepartmentRepository = null;
+    private ?UserLifecyclePolicyDashboardRepository $userLifecyclePolicyDashboardRepository = null;
 
     public function createUserReadRepository(): UserReadRepositoryInterface
     {
@@ -53,4 +56,12 @@ class UserRepositoryFactory
     {
         return $this->userDepartmentRepository ??= new UserDepartmentRepository();
     }
+
+    /**
+     * @api
+     */
+    public function createUserLifecyclePolicyDashboardRepository(): UserLifecyclePolicyDashboardRepositoryInterface
+    {
+        return $this->userLifecyclePolicyDashboardRepository ??= new UserLifecyclePolicyDashboardRepository();
+    }
 }