feat(user-lifecycle): cockpit foundation — KPI row + aside quick actions

Phase 1 of the Stripe-style policy-cockpit redesign for the user-lifecycle
settings page. Pure server-rendering — no async, no JS components, no
sparklines yet (those land in later phases).

Adds a four-tile KPI row above the configuration form (Last run,
Deactivated/30d, Deleted/30d, Pending deletion/7d), populates the
previously empty aside with three quick actions (Run policy now,
Purge logs, Policy reference link), and surfaces a relative-time +
status hint under the existing Run-Now collapsible.

Module-isolation is preserved through a new read-side contract:

* core/Service/Audit/UserLifecycleAuditDashboardInterface — read-only
  pendant to the existing write-side UserLifecycleAuditInterface.
  Methods: lastRun(), summaryByAction(int days), countActionInWindow(...).
* core/Service/Audit/NullUserLifecycleAuditDashboard — fail-closed
  default when the audit module is disabled. KPI tiles 1-3 then
  render "—"; tile 4 (pending deletion) keeps working because it
  lives in the core domain.
* modules/audit/.../Service/UserLifecycleAuditDashboardService — the
  module's implementation; reads through the existing
  UserLifecycleAuditRepository (extended with three new aggregation
  queries: lastRun, countByActionStatusSinceTimestamp, countSinceTimestamp).
* AuditContainerRegistrar binds the interface to the module impl;
  registerContainer.php registers the Null fallback before module
  bindings, mirroring how the write-side audit interface is wired.

The new core service UserLifecyclePolicyDashboardService computes
the pending-deletion-window count from the users table directly
(no audit dependency) — defensive when both policy days are 0
(returns 0 rather than running an unbounded query).

New shared template partial templates/partials/app-kpi-row.phtml is
generic — accepts a $kpiTiles array of {label, count, icon, iconTone,
href, tooltip} and reuses the existing app-tile primitive. Other
settings pages can pick it up without ceremony.

Includes:
* PHPUnit tests for both new services (happy path + Null-fallback +
  policy-disabled edge cases).
* AuditModuleIsolationContractTest allowlist extended for the new
  interface and module service.
* 14 new translation keys in both default_de.json and default_en.json
  (i18n parity verified).

All six quality gates green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/audit/tests/Module/Audit/Service/UserLifecycleAuditDashboardServiceTest.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace MintyPHP\Tests\Module\Audit\Service;
+
+use MintyPHP\Module\Audit\Repository\UserLifecycleAuditRepository;
+use MintyPHP\Module\Audit\Service\UserLifecycleAuditDashboardService;
+use PHPUnit\Framework\TestCase;
+
+class UserLifecycleAuditDashboardServiceTest extends TestCase
+{
+    public function testLastRunReturnsNullWhenRepositoryHasNoSystemRun(): void
+    {
+        $repository = $this->createMock(UserLifecycleAuditRepository::class);
+        $repository->expects($this->once())->method('latestSystemRun')->willReturn(null);
+
+        $service = new UserLifecycleAuditDashboardService($repository);
+
+        $this->assertNull($service->lastRun());
+    }
+
+    public function testLastRunNormalizesRowToContractShape(): void
+    {
+        $repository = $this->createMock(UserLifecycleAuditRepository::class);
+        $repository->method('latestSystemRun')->willReturn([
+            'created_at' => '2026-04-25 12:00:00',
+            'status' => 'success',
+            'action' => 'deactivate',
+        ]);
+
+        $service = new UserLifecycleAuditDashboardService($repository);
+        $row = $service->lastRun();
+
+        $this->assertIsArray($row);
+        $this->assertSame('2026-04-25 12:00:00', $row['created_at']);
+        $this->assertSame('success', $row['status']);
+        $this->assertSame('deactivate', $row['action']);
+    }
+
+    public function testActionCountInWindowReturnsZeroForUnknownAction(): void
+    {
+        $repository = $this->createMock(UserLifecycleAuditRepository::class);
+        $repository->expects($this->never())->method('countActionInWindow');
+
+        $service = new UserLifecycleAuditDashboardService($repository);
+
+        $this->assertSame(0, $service->actionCountInWindow('not-a-real-action', 30));
+    }
+
+    public function testActionCountInWindowReturnsZeroForUnknownStatus(): void
+    {
+        $repository = $this->createMock(UserLifecycleAuditRepository::class);
+        $repository->expects($this->never())->method('countActionInWindow');
+
+        $service = new UserLifecycleAuditDashboardService($repository);
+
+        $this->assertSame(0, $service->actionCountInWindow('deactivate', 30, 'not-a-status'));
+    }
+
+    public function testActionCountInWindowDelegatesNormalizedValuesToRepository(): void
+    {
+        $repository = $this->createMock(UserLifecycleAuditRepository::class);
+        $repository->expects($this->once())
+            ->method('countActionInWindow')
+            ->with('deactivate', 30, 'success')
+            ->willReturn(7);
+
+        $service = new UserLifecycleAuditDashboardService($repository);
+
+        $this->assertSame(7, $service->actionCountInWindow('Deactivate', 30, 'Success'));
+    }
+
+    public function testSummaryByActionReturnsEmptyForUnknownStatus(): void
+    {
+        $repository = $this->createMock(UserLifecycleAuditRepository::class);
+        $repository->expects($this->never())->method('sumByActionInWindow');
+
+        $service = new UserLifecycleAuditDashboardService($repository);
+
+        $this->assertSame([], $service->summaryByAction(30, 'not-a-status'));
+    }
+
+    public function testSummaryByActionDelegatesNormalizedStatus(): void
+    {
+        $repository = $this->createMock(UserLifecycleAuditRepository::class);
+        $repository->expects($this->once())
+            ->method('sumByActionInWindow')
+            ->with(30, 'success')
+            ->willReturn(['deactivate' => 4, 'delete' => 2]);
+
+        $service = new UserLifecycleAuditDashboardService($repository);
+
+        $this->assertSame(
+            ['deactivate' => 4, 'delete' => 2],
+            $service->summaryByAction(30, 'Success')
+        );
+    }
+}