refactor(settings): split security into 4 focused tiles

Extracts user-lifecycle, audit and telemetry from the security subpage
into their own tiles, and renames the slimmed-down security subpage to
account-access for a clearer scope. Each subpage now has at most three
detail cards instead of the eight previously crowded into security.

Hub gains four tiles, sub-action redirects (expire-remember-tokens,
run-user-lifecycle) move to their new sections, architecture tests track
the new section list and i18n adds the new labels in de + en.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

i18n/default_de.json

@@ -33,6 +33,8 @@
   "Access emails sent to %d users, %f failed": "Zugangsdaten an %d Benutzer gesendet, %f fehlgeschlagen",
   "Access PDF": "Zugangs-PDF",
   "Account": "Konto",
+  "Account access": "Kontozugang",
+  "Account access settings": "Kontozugang-Einstellungen",
   "Account is inactive": "Konto ist deaktiviert",
   "Action": "Aktion",
   "Actions": "Aktionen",
@@ -133,6 +135,8 @@
   "Attempts": "Versuche",
   "Attribute mapping and sync": "Attributzuordnung und Synchronisierung",
   "Audit": "Audit",
+  "Audit log": "Audit-Log",
+  "Audit log settings": "Audit-Log-Einstellungen",
   "Authority endpoint": "Authority-Endpunkt",
   "Authority URL": "Authority-URL",
   "Auto-delete is ignored while auto-deactivate is disabled": "Auto-Löschung wird ignoriert, solange Auto-Deaktivierung deaktiviert ist",
@@ -450,6 +454,7 @@
   "Fri": "Fr",
   "Frontend": "Frontend",
   "Frontend telemetry": "Frontend-Telemetrie",
+  "Frontend telemetry collection and event allowlist": "Frontend-Telemetrie-Erfassung und Event-Allowlist",
   "General": "Allgemein",
   "General settings": "Allgemeine Einstellungen",
   "Generate access PDFs for selected users?": "Zugangs-PDFs für ausgewählte Benutzer erstellen?",
@@ -502,6 +507,7 @@
   "Inactive tenants": "Inaktive Mandanten",
   "Inactive tenants are excluded from user access and tenant-scoped data.": "Inaktive Mandanten werden vom Benutzerzugriff und mandantenspezifischen Daten ausgeschlossen.",
   "Inactive users": "Inaktive Benutzer",
+  "Inactivity deactivation and deletion policy": "Richtlinie für Inaktivitäts-Deaktivierung und Löschung",
   "Incomplete": "Unvollständig",
   "Inherit global default": "Globalen Standard verwenden",
   "Internal Server Error": "Interner Serverfehler",
@@ -865,6 +871,7 @@
   "Registration controls whether new users can create an account.": "Hier wird gesteuert, ob neue Benutzer ein Konto erstellen dürfen.",
   "Registration is currently disabled": "Registrierung ist derzeit deaktiviert.",
   "Registration successful! Please check your email for the verification code.": "Registrierung erfolgreich! Bitte prüfe deine E-Mails für den Bestätigungscode.",
+  "Registration, sessions, login persistence": "Registrierung, Sitzungen, Login-Persistenz",
   "Remember login after Microsoft sign-in": "Angemeldet bleiben nach Microsoft-Login",
   "Remember me": "Angemeldet bleiben",
   "Remember token lifetime (days)": "Token-Lebensdauer Angemeldet-bleiben (Tage)",
@@ -934,6 +941,7 @@
   "Rows total": "Zeilen gesamt",
   "Rules": "Regeln",
   "Run history": "Laufhistorie",
+  "Run lifecycle now": "Lebenszyklus jetzt ausführen",
   "Run now": "Jetzt ausführen",
   "Run preview": "Vorschau ausführen",
   "Run user lifecycle now": "Benutzer-Lifecycle jetzt ausführen",
@@ -1138,6 +1146,7 @@
   "System audit controls whether security events are logged and how long they are kept.": "Hier wird gesteuert, ob Sicherheitsereignisse protokolliert werden und wie lange sie aufbewahrt werden.",
   "System audit entry not found": "System-Protokoll-Eintrag nicht gefunden",
   "System audit events (24h)": "System-Protokoll-Ereignisse (24h)",
+  "System audit log enable and retention": "System-Audit-Log aktivieren und Aufbewahrung",
   "System audit logs": "System-Protokolle",
   "System audit risks (24h)": "System-Protokoll-Risiken (24h)",
   "System Info": "Systeminfo",
@@ -1153,7 +1162,9 @@
   "Target type": "Zieltyp",
   "Target UUID": "Ziel-UUID",
   "Tax number": "Steuernummer",
+  "Telemetry": "Telemetrie",
   "Telemetry helps detect recurring UI issues and failed requests in production.": "Telemetry hilft, wiederkehrende UI-Probleme und fehlgeschlagene Requests in Produktion zu erkennen.",
+  "Telemetry settings": "Telemetrie-Einstellungen",
   "Template": "Vorlage",
   "Tenant": "Mandant",
   "Tenant #%d": "Mandant #%d",
@@ -1196,6 +1207,7 @@
   "These limits define default and maximum lifetimes for newly issued API tokens.": "Diese Grenzwerte definieren Standard- und Maximallaufzeit für neu ausgestellte API-Tokens.",
   "This action cannot be undone.": "Diese Aktion kann nicht rückgängig gemacht werden.",
   "This action revokes all active API tokens immediately across all users.": "Diese Aktion widerruft sofort alle aktiven API-Tokens über alle Benutzer hinweg.",
+  "This runs the lifecycle policy immediately and may deactivate or delete users.": "Dies führt die Lebenszyklus-Richtlinie sofort aus und kann Benutzer deaktivieren oder löschen.",
   "This scheduled job is no longer registered and cannot be edited. It has been superseded by a newer version.": "Diese geplante Aufgabe ist nicht mehr registriert und kann nicht bearbeitet werden. Sie wurde durch eine neuere Version ersetzt.",
   "This setting controls the application name shown across the UI.": "Diese Einstellung steuert den in der gesamten UI angezeigten Anwendungsnamen.",
   "This setting controls the default language for users without a personal preference.": "Diese Einstellung steuert die Standardsprache für Benutzer ohne persönliche Präferenz.",
@@ -1277,12 +1289,14 @@
   "User ID": "Benutzer-ID",
   "User inactivity deactivation period is invalid": "Zeitraum für automatische Deaktivierung ist ungültig",
   "User inactivity deletion period is invalid": "Zeitraum für automatische Löschung ist ungültig",
+  "User lifecycle": "Benutzer-Lebenszyklus",
   "User lifecycle already running": "Benutzer-Lifecycle läuft bereits",
   "User lifecycle completed: %d deactivated, %d deleted": "Benutzer-Lifecycle abgeschlossen: %d deaktiviert, %d gelöscht",
   "User lifecycle defines when inactive users are deactivated or deleted.": "Hier wird festgelegt, wann inaktive Benutzer deaktiviert oder gelöscht werden.",
   "User lifecycle failed": "Benutzer-Lifecycle fehlgeschlagen",
   "User lifecycle logs": "Benutzer-Lifecycle-Protokolle",
   "User lifecycle policy": "Benutzer-Lifecycle-Regel",
+  "User lifecycle settings": "Benutzer-Lebenszyklus-Einstellungen",
   "User not found": "Benutzer nicht gefunden",
   "User override disabled": "Benutzer-Override deaktiviert",
   "User override enabled": "Benutzer-Override aktiviert",

i18n/default_en.json

@@ -33,6 +33,8 @@
   "Access emails sent to %d users, %f failed": "Access emails sent to %d users, %f failed",
   "Access PDF": "Access PDF",
   "Account": "Account",
+  "Account access": "Account access",
+  "Account access settings": "Account access settings",
   "Account is inactive": "Account is inactive",
   "Action": "Action",
   "Actions": "Actions",
@@ -133,6 +135,8 @@
   "Attempts": "Attempts",
   "Attribute mapping and sync": "Attribute mapping and sync",
   "Audit": "Audit",
+  "Audit log": "Audit log",
+  "Audit log settings": "Audit log settings",
   "Authority endpoint": "Authority endpoint",
   "Authority URL": "Authority URL",
   "Auto-delete is ignored while auto-deactivate is disabled": "Auto-delete is ignored while auto-deactivate is disabled",
@@ -450,6 +454,7 @@
   "Fri": "Fri",
   "Frontend": "Frontend",
   "Frontend telemetry": "Frontend telemetry",
+  "Frontend telemetry collection and event allowlist": "Frontend telemetry collection and event allowlist",
   "General": "General",
   "General settings": "General settings",
   "Generate access PDFs for selected users?": "Generate access PDFs for selected users?",
@@ -502,6 +507,7 @@
   "Inactive tenants": "Inactive tenants",
   "Inactive tenants are excluded from user access and tenant-scoped data.": "Inactive tenants are excluded from user access and tenant-scoped data.",
   "Inactive users": "Inactive users",
+  "Inactivity deactivation and deletion policy": "Inactivity deactivation and deletion policy",
   "Incomplete": "Incomplete",
   "Inherit global default": "Inherit global default",
   "Internal Server Error": "Internal Server Error",
@@ -865,6 +871,7 @@
   "Registration controls whether new users can create an account.": "Registration controls whether new users can create an account.",
   "Registration is currently disabled": "Registration is currently disabled.",
   "Registration successful! Please check your email for the verification code.": "Registration successful! Please check your email for the verification code.",
+  "Registration, sessions, login persistence": "Registration, sessions, login persistence",
   "Remember login after Microsoft sign-in": "Remember login after Microsoft sign-in",
   "Remember me": "Remember me",
   "Remember token lifetime (days)": "Remember token lifetime (days)",
@@ -934,6 +941,7 @@
   "Rows total": "Rows total",
   "Rules": "Rules",
   "Run history": "Run history",
+  "Run lifecycle now": "Run lifecycle now",
   "Run now": "Run now",
   "Run preview": "Run preview",
   "Run user lifecycle now": "Run user lifecycle now",
@@ -1138,6 +1146,7 @@
   "System audit controls whether security events are logged and how long they are kept.": "System audit controls whether security events are logged and how long they are kept.",
   "System audit entry not found": "System audit entry not found",
   "System audit events (24h)": "System audit events (24h)",
+  "System audit log enable and retention": "System audit log enable and retention",
   "System audit logs": "System audit logs",
   "System audit risks (24h)": "System audit risks (24h)",
   "System Info": "System Info",
@@ -1153,7 +1162,9 @@
   "Target type": "Target type",
   "Target UUID": "Target UUID",
   "Tax number": "Tax number",
+  "Telemetry": "Telemetry",
   "Telemetry helps detect recurring UI issues and failed requests in production.": "Telemetry helps detect recurring UI issues and failed requests in production.",
+  "Telemetry settings": "Telemetry settings",
   "Template": "Template",
   "Tenant": "Tenant",
   "Tenant #%d": "Tenant #%d",
@@ -1196,6 +1207,7 @@
   "These limits define default and maximum lifetimes for newly issued API tokens.": "These limits define default and maximum lifetimes for newly issued API tokens.",
   "This action cannot be undone.": "This action cannot be undone.",
   "This action revokes all active API tokens immediately across all users.": "This action revokes all active API tokens immediately across all users.",
+  "This runs the lifecycle policy immediately and may deactivate or delete users.": "This runs the lifecycle policy immediately and may deactivate or delete users.",
   "This scheduled job is no longer registered and cannot be edited. It has been superseded by a newer version.": "This scheduled job is no longer registered and cannot be edited. It has been superseded by a newer version.",
   "This setting controls the application name shown across the UI.": "This setting controls the application name shown across the UI.",
   "This setting controls the default language for users without a personal preference.": "This setting controls the default language for users without a personal preference.",
@@ -1277,12 +1289,14 @@
   "User ID": "User ID",
   "User inactivity deactivation period is invalid": "User inactivity deactivation period is invalid",
   "User inactivity deletion period is invalid": "User inactivity deletion period is invalid",
+  "User lifecycle": "User lifecycle",
   "User lifecycle already running": "User lifecycle already running",
   "User lifecycle completed: %d deactivated, %d deleted": "User lifecycle completed: %d deactivated, %d deleted",
   "User lifecycle defines when inactive users are deactivated or deleted.": "User lifecycle defines when inactive users are deactivated or deleted.",
   "User lifecycle failed": "User lifecycle failed",
   "User lifecycle logs": "User lifecycle logs",
   "User lifecycle policy": "User lifecycle policy",
+  "User lifecycle settings": "User lifecycle settings",
   "User not found": "User not found",
   "User override disabled": "User override disabled",
   "User override enabled": "User override enabled",