fix(users): default user detail to Security tab via index redirect - #1755

Summary

The user detail page always renders the Security tab, but landing on the bare /users/:userId (e.g. via the detail breadcrumb or a direct link) left the URL without the /security suffix, so the Security chip didn't appear selected. This PR makes /users/:userId/security the canonical default route via a route-level redirect, so the tab is always selected and the URL is consistent.

Changes

• Add an index redirect from /users/:userId to /users/:userId/security, mirroring the existing org-detail default-tab pattern (members).

Technical Details

The :userId route is now an element-less path group with two children: an index route that renders <Navigate to="security" replace /> and a security route that renders UsersPage. Because the parent has no element, there's no <Outlet /> requirement — the matched child's element (UsersPage) renders directly. The redirect handles every entry into the bare user URL (breadcrumb, direct link), and the Security chip's existing active check (currentPath.startsWith(link.path)) then matches — no navbar change or component-level useEffect needed.

Test Plan

• Manual testing completed
  • Verified /users/:userId redirects to /users/:userId/security with the Security tab selected.
  • Verified the breadcrumb avatar/name lands on the /security URL via the redirect.
  • Verified user row clicks (already targeting /security) still work as before.
  • Verified unknown subpaths (e.g. /users/:userId/foo) no longer render the detail view (fall through to the app catch-all redirect).
• Build and type checking passes

SQL Safety (if your PR touches *_repository.go or goqu.*)

N/A