refactor(settings): split security into 4 focused tiles

Extracts user-lifecycle, audit and telemetry from the security subpage
into their own tiles, and renames the slimmed-down security subpage to
account-access for a clearer scope. Each subpage now has at most three
detail cards instead of the eight previously crowded into security.

Hub gains four tiles, sub-action redirects (expire-remember-tokens,
run-user-lifecycle) move to their new sections, architecture tests track
the new section list and i18n adds the new labels in de + en.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

i18n/default_en.json

@@ -33,6 +33,8 @@
   "Access emails sent to %d users, %f failed": "Access emails sent to %d users, %f failed",
   "Access PDF": "Access PDF",
   "Account": "Account",
+  "Account access": "Account access",
+  "Account access settings": "Account access settings",
   "Account is inactive": "Account is inactive",
   "Action": "Action",
   "Actions": "Actions",
@@ -133,6 +135,8 @@
   "Attempts": "Attempts",
   "Attribute mapping and sync": "Attribute mapping and sync",
   "Audit": "Audit",
+  "Audit log": "Audit log",
+  "Audit log settings": "Audit log settings",
   "Authority endpoint": "Authority endpoint",
   "Authority URL": "Authority URL",
   "Auto-delete is ignored while auto-deactivate is disabled": "Auto-delete is ignored while auto-deactivate is disabled",
@@ -450,6 +454,7 @@
   "Fri": "Fri",
   "Frontend": "Frontend",
   "Frontend telemetry": "Frontend telemetry",
+  "Frontend telemetry collection and event allowlist": "Frontend telemetry collection and event allowlist",
   "General": "General",
   "General settings": "General settings",
   "Generate access PDFs for selected users?": "Generate access PDFs for selected users?",
@@ -502,6 +507,7 @@
   "Inactive tenants": "Inactive tenants",
   "Inactive tenants are excluded from user access and tenant-scoped data.": "Inactive tenants are excluded from user access and tenant-scoped data.",
   "Inactive users": "Inactive users",
+  "Inactivity deactivation and deletion policy": "Inactivity deactivation and deletion policy",
   "Incomplete": "Incomplete",
   "Inherit global default": "Inherit global default",
   "Internal Server Error": "Internal Server Error",
@@ -865,6 +871,7 @@
   "Registration controls whether new users can create an account.": "Registration controls whether new users can create an account.",
   "Registration is currently disabled": "Registration is currently disabled.",
   "Registration successful! Please check your email for the verification code.": "Registration successful! Please check your email for the verification code.",
+  "Registration, sessions, login persistence": "Registration, sessions, login persistence",
   "Remember login after Microsoft sign-in": "Remember login after Microsoft sign-in",
   "Remember me": "Remember me",
   "Remember token lifetime (days)": "Remember token lifetime (days)",
@@ -934,6 +941,7 @@
   "Rows total": "Rows total",
   "Rules": "Rules",
   "Run history": "Run history",
+  "Run lifecycle now": "Run lifecycle now",
   "Run now": "Run now",
   "Run preview": "Run preview",
   "Run user lifecycle now": "Run user lifecycle now",
@@ -1138,6 +1146,7 @@
   "System audit controls whether security events are logged and how long they are kept.": "System audit controls whether security events are logged and how long they are kept.",
   "System audit entry not found": "System audit entry not found",
   "System audit events (24h)": "System audit events (24h)",
+  "System audit log enable and retention": "System audit log enable and retention",
   "System audit logs": "System audit logs",
   "System audit risks (24h)": "System audit risks (24h)",
   "System Info": "System Info",
@@ -1153,7 +1162,9 @@
   "Target type": "Target type",
   "Target UUID": "Target UUID",
   "Tax number": "Tax number",
+  "Telemetry": "Telemetry",
   "Telemetry helps detect recurring UI issues and failed requests in production.": "Telemetry helps detect recurring UI issues and failed requests in production.",
+  "Telemetry settings": "Telemetry settings",
   "Template": "Template",
   "Tenant": "Tenant",
   "Tenant #%d": "Tenant #%d",
@@ -1196,6 +1207,7 @@
   "These limits define default and maximum lifetimes for newly issued API tokens.": "These limits define default and maximum lifetimes for newly issued API tokens.",
   "This action cannot be undone.": "This action cannot be undone.",
   "This action revokes all active API tokens immediately across all users.": "This action revokes all active API tokens immediately across all users.",
+  "This runs the lifecycle policy immediately and may deactivate or delete users.": "This runs the lifecycle policy immediately and may deactivate or delete users.",
   "This scheduled job is no longer registered and cannot be edited. It has been superseded by a newer version.": "This scheduled job is no longer registered and cannot be edited. It has been superseded by a newer version.",
   "This setting controls the application name shown across the UI.": "This setting controls the application name shown across the UI.",
   "This setting controls the default language for users without a personal preference.": "This setting controls the default language for users without a personal preference.",
@@ -1277,12 +1289,14 @@
   "User ID": "User ID",
   "User inactivity deactivation period is invalid": "User inactivity deactivation period is invalid",
   "User inactivity deletion period is invalid": "User inactivity deletion period is invalid",
+  "User lifecycle": "User lifecycle",
   "User lifecycle already running": "User lifecycle already running",
   "User lifecycle completed: %d deactivated, %d deleted": "User lifecycle completed: %d deactivated, %d deleted",
   "User lifecycle defines when inactive users are deactivated or deleted.": "User lifecycle defines when inactive users are deactivated or deleted.",
   "User lifecycle failed": "User lifecycle failed",
   "User lifecycle logs": "User lifecycle logs",
   "User lifecycle policy": "User lifecycle policy",
+  "User lifecycle settings": "User lifecycle settings",
   "User not found": "User not found",
   "User override disabled": "User override disabled",
   "User override enabled": "User override enabled",