[Epic] `MetamaskController` decomposition: Extract Extension-specific modules

Extract the five extension-specific modules from `MetamaskController`. All five live under `app/scripts/lib/` (not `wallet-services/`) because they touch browser APIs.

**Parent Epic:** [#41735 — `MetamaskController` decomposition](https://github.com/MetaMask/metamask-extension/issues/41735)

## Tickets

| # | Ticket | Size |
| --- | ---------------------------------------------------------- | ---- |
| B.1 | Extract `session-manager` | M |
| B.2 | Extract `connection-manager` | L |
| B.3 | Extract `hardware-wallet` | M |
| B.4 | Extract `controller-subscriptions` | M |
| B.5 | Extract `provider-engine` | L |

Each ticket delivers: (1) create the module directory, (2) port the method bodies from `metamask-controller.js` into the target module, (3) delete the `MetamaskController`-side originals and rewrite any `getApi()` entries to call `messenger.call('Module:action', ...)` directly — no forwarding stub (a method whose entire body is a single `this.controllerMessenger.call(...)` delegation) may remain after the PR lands, and (4) add unit tests. No separate "final deletion" or "integration verification" ticket exists — each extraction PR is complete on its own.

## Success bar

- All 5 modules extracted to `main` with full bodies and unit tests
- `MetamaskController` no longer holds method bodies for any of these domains
- B.4 depends on B.1 (needs `SessionManager:onLock` / `SessionManager:onUnlock` actions registered)
- B.5 depends on B.2 (needs `ConnectionManager` caller interface stable)

Start in app/scripts/lib/metamask-controller.js and map the five listed domains to their extraction tickets. Read the parent epic and account for the B.4 dependency on B.1 and B.5 dependency on B.2 before choosing a ticket. Done means each module has full method bodies and unit tests, getApi() calls the module actions directly, and no listed method bodies or forwarding stubs remain in MetamaskController.

Written by the indexing model from the issue text.