feat: add read-only System Info admin page with health checks and module inventory

New page at /admin/system-info with three tabs:
- Overview: PHP version, SAPI, environment, 6 health checks (DB, schema,
  storage, RBAC baseline, admin role, scheduler heartbeat)
- Modules: table of active modules with version, dependencies, permission count
- Permissions: active/inactive counts and per-source breakdown

Gated behind new system_info.view permission assigned to Admin role.
No mutations — purely diagnostic/observability.

Includes SystemHealthService, SystemInfoService, SystemHealthRepository
with interface, DI registration, i18n keys (de+en), idempotent DB update
script, and 17 new PHPUnit tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

templates/partials/app-main-aside.phtml

@@ -19,6 +19,7 @@ $canViewSystemAudit = (bool) ($layoutAuth['can_view_system_audit'] ?? false);
 $canViewImportsAudit = (bool) ($layoutAuth['can_view_imports_audit'] ?? false);
 $canViewUserLifecycleAudit = (bool) ($layoutAuth['can_view_user_lifecycle_audit'] ?? false);
 $canViewStats = (bool) ($layoutAuth['can_view_stats'] ?? false);
+$canViewSystemInfo = (bool) ($layoutAuth['can_view_system_info'] ?? false);
 $docsDefaultSlug = DocsCatalogService::defaultSlug();
 $docsDefaultPath = 'admin/docs/' . $docsDefaultSlug;
 $hasOrganization = $canViewTenants || $canViewDepartments || $canViewUsers;
@@ -26,7 +27,7 @@ $hasUsersSection = $canViewRoles || $canViewPermissions;
 $hasAutomationSection = $canViewImports || $canViewJobs || $canViewApiDocs;
 $hasMonitoringSection = $canViewStats;
 $hasLogsSection = $canViewMailLog || $canViewApiAudit || $canViewSystemAudit || $canViewImportsAudit || $canViewUserLifecycleAudit;
-$hasSystemSection = $canViewSettings || $canViewDocs;
+$hasSystemSection = $canViewSettings || $canViewSystemInfo || $canViewDocs;
 $hasAdminPanel = layoutHasAdminPanel($layoutAuth);
 
 // Declarative nav config for admin panel groups
@@ -182,6 +183,13 @@ $adminNavGroups = [
                 'visible' => $canViewSettings,
                 'withTenant' => false,
             ],
+            [
+                'label' => t('System Info'),
+                'path' => 'admin/system-info',
+                'active' => navActive('admin/system-info', true),
+                'visible' => $canViewSystemInfo,
+                'withTenant' => false,
+            ],
             [
                 'label' => t('Documentation'),
                 'path' => $docsDefaultPath,