refactor(actions): introduce action-context helpers (step 1)

Six orthogonal building blocks plus three cluster aggregators in
core/Support/helpers/action_context.php, preparing consolidation of the
~40-60 line vorspiel duplicated across edit/create/view-fragment actions.

Step 1 of a planned 3-step rollout: no production call sites yet —
pages/ and modules/ are untouched. Architecture tests freeze the
building-block signatures and verify drawer-fragment AuthZ parity.

GR-SEC-009 is structurally enforced via the actionDeriveTenantScope
return shape (PHPStan array{scope: 'all'|'list', ids: list<int>});
'all' is unreachable without an explicit can_manage_all_tenants flag.
Aggregator docblocks carry a mandatory CSRF-pairing warning per
GR-SEC-001; actionBuildViewAuth flags the e()-escape obligation per
GR-SEC-010.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/Support/helpers.php

@@ -3,6 +3,7 @@
 // Load all global helper groups used by templates and page actions.
 require __DIR__ . '/helpers/admin_settings.php';
 require __DIR__ . '/helpers/app.php';
+require __DIR__ . '/helpers/action_context.php';
 require __DIR__ . '/helpers/array.php';
 require __DIR__ . '/helpers/branding.php';
 require __DIR__ . '/helpers/export.php';