feat(user-lifecycle): cockpit foundation — KPI row + aside quick actions

Phase 1 of the Stripe-style policy-cockpit redesign for the user-lifecycle
settings page. Pure server-rendering — no async, no JS components, no
sparklines yet (those land in later phases).

Adds a four-tile KPI row above the configuration form (Last run,
Deactivated/30d, Deleted/30d, Pending deletion/7d), populates the
previously empty aside with three quick actions (Run policy now,
Purge logs, Policy reference link), and surfaces a relative-time +
status hint under the existing Run-Now collapsible.

Module-isolation is preserved through a new read-side contract:

* core/Service/Audit/UserLifecycleAuditDashboardInterface — read-only
  pendant to the existing write-side UserLifecycleAuditInterface.
  Methods: lastRun(), summaryByAction(int days), countActionInWindow(...).
* core/Service/Audit/NullUserLifecycleAuditDashboard — fail-closed
  default when the audit module is disabled. KPI tiles 1-3 then
  render "—"; tile 4 (pending deletion) keeps working because it
  lives in the core domain.
* modules/audit/.../Service/UserLifecycleAuditDashboardService — the
  module's implementation; reads through the existing
  UserLifecycleAuditRepository (extended with three new aggregation
  queries: lastRun, countByActionStatusSinceTimestamp, countSinceTimestamp).
* AuditContainerRegistrar binds the interface to the module impl;
  registerContainer.php registers the Null fallback before module
  bindings, mirroring how the write-side audit interface is wired.

The new core service UserLifecyclePolicyDashboardService computes
the pending-deletion-window count from the users table directly
(no audit dependency) — defensive when both policy days are 0
(returns 0 rather than running an unbounded query).

New shared template partial templates/partials/app-kpi-row.phtml is
generic — accepts a $kpiTiles array of {label, count, icon, iconTone,
href, tooltip} and reuses the existing app-tile primitive. Other
settings pages can pick it up without ceremony.

Includes:
* PHPUnit tests for both new services (happy path + Null-fallback +
  policy-disabled edge cases).
* AuditModuleIsolationContractTest allowlist extended for the new
  interface and module service.
* 14 new translation keys in both default_de.json and default_en.json
  (i18n parity verified).

All six quality gates green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pages/admin/settings/user-lifecycle(default).phtml

@@ -4,6 +4,9 @@
  * @var array $values
  * @var array $settings
  * @var bool  $canUpdateSettings
+ * @var array<int, array<string, mixed>> $kpiTiles
+ * @var string $lastRunSummary
+ * @var array<int, array<string, mixed>> $asideActions
  */
 
 use MintyPHP\Session;
@@ -17,6 +20,9 @@ $userInactivityDeleteDaysDesc = $settings['user_inactivity_delete_days']['descri
 $canUpdateSettings = (bool) ($canUpdateSettings ?? false);
 $isReadOnly = !$canUpdateSettings;
 $readonlyAttr = $isReadOnly ? 'readonly' : '';
+$kpiTiles = is_array($kpiTiles ?? null) ? $kpiTiles : [];
+$lastRunSummary = (string) ($lastRunSummary ?? '');
+$asideActions = is_array($asideActions ?? null) ? $asideActions : [];
 $layoutAuth = is_array($viewAuth['layout'] ?? null) ? $viewAuth['layout'] : [];
 $layoutNav = is_array($layoutNav ?? null) ? $layoutNav : [];
 $moduleSlots = is_array($layoutNav['moduleSlots'] ?? null) ? $layoutNav['moduleSlots'] : [];
@@ -52,6 +58,8 @@ $moduleLifecyclePanelSlots = is_array($moduleSlots['settings.user_lifecycle.pane
     require templatePath('partials/app-details-titlebar.phtml');
     ?>
 
+    <?php require templatePath('partials/app-kpi-row.phtml'); ?>
+
     <form id="settings-user-lifecycle-form" method="post" data-details-storage="settings-user-lifecycle-details-v1" data-standard-detail-form="1">
       <div class="grid">
         <label class="app-field">
@@ -74,6 +82,9 @@ $moduleLifecyclePanelSlots = is_array($moduleSlots['settings.user_lifecycle.pane
         <details class="app-details-card" name="settings-user-lifecycle-run-now" data-details-key="settings-user-lifecycle-run-now">
           <summary>
             <span class="app-details-card-summary-title"><?php e(t('Run lifecycle now')); ?></span>
+            <?php if ($lastRunSummary !== ''): ?>
+              <span class="app-details-card-summary-meta"><?php e($lastRunSummary); ?></span>
+            <?php endif; ?>
           </summary>
           <div class="app-details-card-container">
             <blockquote data-variant="warning">
@@ -111,6 +122,8 @@ $moduleLifecyclePanelSlots = is_array($moduleSlots['settings.user_lifecycle.pane
     <?php endforeach; ?>
   </section>
   <aside id="app-details-aside-section">
-    <div class="app-details-aside-section"></div>
+    <div class="app-details-aside-section">
+      <?php require templatePath('partials/app-details-aside-actions.phtml'); ?>
+    </div>
   </aside>
 </div>