refactor(settings): split security into 4 focused tiles

Extracts user-lifecycle, audit and telemetry from the security subpage
into their own tiles, and renames the slimmed-down security subpage to
account-access for a clearer scope. Each subpage now has at most three
detail cards instead of the eight previously crowded into security.

Hub gains four tiles, sub-action redirects (expire-remember-tokens,
run-user-lifecycle) move to their new sections, architecture tests track
the new section list and i18n adds the new labels in de + en.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pages/admin/settings/audit(default).phtml

@@ -0,0 +1,87 @@
+<?php
+
+/**
+ * @var array $values
+ * @var array $settings
+ * @var bool  $canUpdateSettings
+ */
+
+use MintyPHP\Session;
+
+$values = $values ?? [];
+$settings = $settings ?? [];
+$systemAuditEnabled = !empty($values['system_audit_enabled']);
+$systemAuditRetentionDays = (int) ($values['system_audit_retention_days'] ?? 365);
+$systemAuditRetentionDaysDesc = $settings['system_audit_retention_days']['description'] ?? 'setting.system_audit_retention_days';
+$canUpdateSettings = (bool) ($canUpdateSettings ?? false);
+$isReadOnly = !$canUpdateSettings;
+$readonlyAttr = $isReadOnly ? 'readonly' : '';
+$disabledAttr = $isReadOnly ? 'disabled' : '';
+?>
+
+<div class="app-details-container">
+  <section>
+    <?php
+    $titlebar = [
+      'title' => t('Audit log settings'),
+      'backHref' => 'admin/settings',
+      'backTitle' => t('Cancel'),
+      'actions' => $canUpdateSettings ? [
+        [
+          'form' => 'settings-audit-form',
+          'name' => 'action',
+          'value' => 'save',
+          'class' => 'secondary outline',
+          'label' => t('Save'),
+        ],
+        [
+          'form' => 'settings-audit-form',
+          'name' => 'action',
+          'value' => 'save_close',
+          'class' => 'primary',
+          'label' => t('Save & close'),
+        ],
+      ] : [],
+    ];
+    require templatePath('partials/app-details-titlebar.phtml');
+    ?>
+
+    <form id="settings-audit-form" method="post" data-details-storage="settings-audit-details-v1" data-standard-detail-form="1">
+      <details class="app-details-card" name="settings-audit-system" data-details-key="settings-audit-system" open>
+        <summary>
+          <span class="app-details-card-summary-title"><?php e(t('System audit')); ?></span>
+          <span class="app-details-card-summary-meta">
+            <span class="badge" data-variant="neutral"><?php e($systemAuditEnabled ? t('Enabled') : t('Disabled')); ?></span>
+          </span>
+        </summary>
+        <div class="app-details-card-container">
+          <blockquote data-variant="info">
+            <small><?php e(t('System audit controls whether security events are logged and how long they are kept.')); ?></small>
+          </blockquote>
+          <label class="app-field">
+            <input type="checkbox" name="system_audit_enabled" value="1" <?php e($systemAuditEnabled ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
+            <span><?php e(t('Enable system audit log')); ?></span>
+          </label>
+          <hr>
+          <label class="app-field">
+            <span><?php e(t('Retention (days)')); ?></span>
+            <input
+              type="number"
+              name="system_audit_retention_days"
+              value="<?php e((string) $systemAuditRetentionDays); ?>"
+              min="30"
+              max="1095"
+              step="1"
+              <?php e($readonlyAttr); ?>>
+            <small><?php e(t($systemAuditRetentionDaysDesc)); ?></small>
+          </label>
+        </div>
+      </details>
+
+      <?php Session::getCsrfInput(); ?>
+    </form>
+  </section>
+  <aside id="app-details-aside-section">
+    <div class="app-details-aside-section"></div>
+  </aside>
+</div>