refactor(settings): split security into 4 focused tiles

Extracts user-lifecycle, audit and telemetry from the security subpage
into their own tiles, and renames the slimmed-down security subpage to
account-access for a clearer scope. Each subpage now has at most three
detail cards instead of the eight previously crowded into security.

Hub gains four tiles, sub-action redirects (expire-remember-tokens,
run-user-lifecycle) move to their new sections, architecture tests track
the new section list and i18n adds the new labels in de + en.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pages/admin/settings/user-lifecycle(default).phtml

@@ -0,0 +1,107 @@
+<?php
+
+/**
+ * @var array $values
+ * @var array $settings
+ * @var bool  $canUpdateSettings
+ */
+
+use MintyPHP\Session;
+
+$values = $values ?? [];
+$settings = $settings ?? [];
+$userInactivityDeactivateDays = (int) ($values['user_inactivity_deactivate_days'] ?? 180);
+$userInactivityDeleteDays = (int) ($values['user_inactivity_delete_days'] ?? 365);
+$userInactivityDeactivateDaysDesc = $settings['user_inactivity_deactivate_days']['description'] ?? 'setting.user_inactivity_deactivate_days';
+$userInactivityDeleteDaysDesc = $settings['user_inactivity_delete_days']['description'] ?? 'setting.user_inactivity_delete_days';
+$canUpdateSettings = (bool) ($canUpdateSettings ?? false);
+$isReadOnly = !$canUpdateSettings;
+$readonlyAttr = $isReadOnly ? 'readonly' : '';
+?>
+
+<div class="app-details-container">
+  <section>
+    <?php
+    $titlebar = [
+      'title' => t('User lifecycle settings'),
+      'backHref' => 'admin/settings',
+      'backTitle' => t('Cancel'),
+      'actions' => $canUpdateSettings ? [
+        [
+          'form' => 'settings-user-lifecycle-form',
+          'name' => 'action',
+          'value' => 'save',
+          'class' => 'secondary outline',
+          'label' => t('Save'),
+        ],
+        [
+          'form' => 'settings-user-lifecycle-form',
+          'name' => 'action',
+          'value' => 'save_close',
+          'class' => 'primary',
+          'label' => t('Save & close'),
+        ],
+      ] : [],
+    ];
+    require templatePath('partials/app-details-titlebar.phtml');
+    ?>
+
+    <form id="settings-user-lifecycle-form" method="post" data-details-storage="settings-user-lifecycle-details-v1" data-standard-detail-form="1">
+      <details class="app-details-card" name="settings-user-lifecycle-policy" data-details-key="settings-user-lifecycle-policy" open>
+        <summary>
+          <span class="app-details-card-summary-title"><?php e(t('User lifecycle policy')); ?></span>
+          <span class="app-details-card-summary-meta">
+            <span class="badge" data-variant="neutral"><?php e((string) $userInactivityDeactivateDays); ?></span>
+            <span class="badge" data-variant="neutral"><?php e((string) $userInactivityDeleteDays); ?></span>
+          </span>
+        </summary>
+        <div class="app-details-card-container">
+          <blockquote data-variant="info">
+            <small><?php e(t('User lifecycle defines when inactive users are deactivated or deleted.')); ?></small>
+          </blockquote>
+          <div class="grid">
+            <label class="app-field">
+              <span><?php e(t('Deactivate users after inactivity (days)')); ?></span>
+              <input type="number" name="user_inactivity_deactivate_days"
+                value="<?php e((string) $userInactivityDeactivateDays); ?>" min="0" max="3650" step="1"
+                <?php e($readonlyAttr); ?>>
+              <small><?php e(t($userInactivityDeactivateDaysDesc)); ?> - <?php e(t('0 disables this rule')); ?></small>
+            </label>
+            <label class="app-field">
+              <span><?php e(t('Delete inactive users after (days)')); ?></span>
+              <input type="number" name="user_inactivity_delete_days"
+                value="<?php e((string) $userInactivityDeleteDays); ?>" min="0" max="3650" step="1"
+                <?php e($readonlyAttr); ?>>
+              <small><?php e(t($userInactivityDeleteDaysDesc)); ?> - <?php e(t('0 disables this rule')); ?></small>
+            </label>
+          </div>
+        </div>
+      </details>
+
+      <?php if ($canUpdateSettings): ?>
+        <details class="app-details-card" name="settings-user-lifecycle-run-now" data-details-key="settings-user-lifecycle-run-now">
+          <summary>
+            <span class="app-details-card-summary-title"><?php e(t('Run lifecycle now')); ?></span>
+          </summary>
+          <div class="app-details-card-container">
+            <blockquote data-variant="warning">
+              <small><?php e(t('This runs the lifecycle policy immediately and may deactivate or delete users.')); ?></small>
+            </blockquote>
+            <button type="submit" class="danger" formnovalidate
+              formaction="admin/settings/run-user-lifecycle"
+              formmethod="post"
+              data-detail-confirm-message="<?php e(t('Run user lifecycle now?')); ?>"
+              data-detail-action-kind="danger">
+              <?php e(t('Run user lifecycle now')); ?>
+            </button>
+          </div>
+        </details>
+      <?php endif; ?>
+
+      <?php Session::getCsrfInput(); ?>
+    </form>
+  </section>
+  <aside id="app-details-aside-section">
+    <div class="app-details-aside-section"></div>
+  </aside>
+</div>