feat: module architecture improvements — session keys, dependency graph, event dispatcher, deactivation hooks

Six targeted improvements to the modular monolith platform:

1. Fix AddressBook session key prefix to follow module.<id>.* convention
2. Move ADDRESS_BOOK_VIEW permission constant from core PermissionService into module
3. Add declarative JSON schema for module manifests (.agents/contracts/)
4. Add `requires` field with missing-dependency and circular-dependency detection
5. Add lightweight fire-and-forget event dispatcher (user.created/deleted/login/logout)
6. Add module deactivation hook interface and CLI script (bin/module-deactivate.php)

Includes 15 new architecture/unit tests covering all new functionality.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/Architecture/NoAddressBookHardcodingTest.php

@@ -12,8 +12,7 @@ use FilesystemIterator;
  * in the search infrastructure, layout context builder, or aside templates.
  *
  * Intentionally allowed in Core (not flagged):
- * - PermissionService::ADDRESS_BOOK_VIEW (general people-visibility gate)
- * - OperationsAuthorizationPolicy / UiCapabilityMap / UserAuthorizationPolicy (authorization)
+ * - OperationsAuthorizationPolicy / UiCapabilityMap / UserAuthorizationPolicy (authorization — uses inline 'address_book.view' string)
  * - modules/addressbook/* (module-owned runtime, pages/assets/providers)
  * - i18n translation files
  * - Module directory (lib/Module/, modules/)