feat(user-lifecycle): cockpit foundation — KPI row + aside quick actions

Phase 1 of the Stripe-style policy-cockpit redesign for the user-lifecycle
settings page. Pure server-rendering — no async, no JS components, no
sparklines yet (those land in later phases).

Adds a four-tile KPI row above the configuration form (Last run,
Deactivated/30d, Deleted/30d, Pending deletion/7d), populates the
previously empty aside with three quick actions (Run policy now,
Purge logs, Policy reference link), and surfaces a relative-time +
status hint under the existing Run-Now collapsible.

Module-isolation is preserved through a new read-side contract:

* core/Service/Audit/UserLifecycleAuditDashboardInterface — read-only
  pendant to the existing write-side UserLifecycleAuditInterface.
  Methods: lastRun(), summaryByAction(int days), countActionInWindow(...).
* core/Service/Audit/NullUserLifecycleAuditDashboard — fail-closed
  default when the audit module is disabled. KPI tiles 1-3 then
  render "—"; tile 4 (pending deletion) keeps working because it
  lives in the core domain.
* modules/audit/.../Service/UserLifecycleAuditDashboardService — the
  module's implementation; reads through the existing
  UserLifecycleAuditRepository (extended with three new aggregation
  queries: lastRun, countByActionStatusSinceTimestamp, countSinceTimestamp).
* AuditContainerRegistrar binds the interface to the module impl;
  registerContainer.php registers the Null fallback before module
  bindings, mirroring how the write-side audit interface is wired.

The new core service UserLifecyclePolicyDashboardService computes
the pending-deletion-window count from the users table directly
(no audit dependency) — defensive when both policy days are 0
(returns 0 rather than running an unbounded query).

New shared template partial templates/partials/app-kpi-row.phtml is
generic — accepts a $kpiTiles array of {label, count, icon, iconTone,
href, tooltip} and reuses the existing app-tile primitive. Other
settings pages can pick it up without ceremony.

Includes:
* PHPUnit tests for both new services (happy path + Null-fallback +
  policy-disabled edge cases).
* AuditModuleIsolationContractTest allowlist extended for the new
  interface and module service.
* 14 new translation keys in both default_de.json and default_en.json
  (i18n parity verified).

All six quality gates green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

i18n/default_de.json

@@ -1381,5 +1381,19 @@
   "Your LDAP account does not have an email address configured.": "Ihr LDAP-Konto hat keine E-Mail-Adresse konfiguriert.",
   "Your session has expired. Please log in again.": "Ihre Sitzung ist abgelaufen. Bitte melden Sie sich erneut an. Mit „Angemeldet bleiben“ erfolgt die Anmeldung ggf. automatisch.",
   "Your session will expire in {countdown}. Would you like to continue?": "Ihre Sitzung läuft in {countdown} ab. Möchten Sie fortfahren?",
-  "ZIP support missing (ext-zip)": "ZIP-Unterstützung fehlt (ext-zip)"
+  "ZIP support missing (ext-zip)": "ZIP-Unterstützung fehlt (ext-zip)",
+  "Deactivated": "Deaktiviert",
+  "Deleted": "Gelöscht",
+  "Pending deletion": "Fällige Löschung",
+  "No runs yet": "Bisher keine Läufe",
+  "Policy reference": "Policy-Referenz",
+  "View activity": "Aktivität anzeigen",
+  "Last 30 days": "Letzte 30 Tage",
+  "Next 7 days": "Nächste 7 Tage",
+  "%d days ago": "vor %d Tagen",
+  "today": "heute",
+  "yesterday": "gestern",
+  "Run policy now": "Policy jetzt ausführen",
+  "Purge logs": "Logs bereinigen",
+  "Purge old user lifecycle audit log entries?": "Alte Benutzer-Lifecycle-Audit-Einträge bereinigen?"
 }

i18n/default_en.json

@@ -1381,5 +1381,19 @@
   "Your LDAP account does not have an email address configured.": "Your LDAP account does not have an email address configured.",
   "Your session has expired. Please log in again.": "Your session timed out. Please sign in again. If you chose Remember me, sign-in can happen automatically.",
   "Your session will expire in {countdown}. Would you like to continue?": "Your session will expire in {countdown}. Would you like to continue?",
-  "ZIP support missing (ext-zip)": "ZIP support missing (ext-zip)"
+  "ZIP support missing (ext-zip)": "ZIP support missing (ext-zip)",
+  "Deactivated": "Deactivated",
+  "Deleted": "Deleted",
+  "Pending deletion": "Pending deletion",
+  "No runs yet": "No runs yet",
+  "Policy reference": "Policy reference",
+  "View activity": "View activity",
+  "Last 30 days": "Last 30 days",
+  "Next 7 days": "Next 7 days",
+  "%d days ago": "%d days ago",
+  "today": "today",
+  "yesterday": "yesterday",
+  "Run policy now": "Run policy now",
+  "Purge logs": "Purge logs",
+  "Purge old user lifecycle audit log entries?": "Purge old user lifecycle audit log entries?"
 }