refactor(web): members and SSO move onto the settings page

/settings/instance held two cards — Members and Single sign-on — behind a
sidebar entry called "Instance", next to one called "Settings". Nothing in
either name told you which held what, and the split left both pages thin.

They are now the Access group at the top of /settings, above Monitoring and
Integrations. Six cards on one page needs sorting into groups or it reads as
a pile, so each group carries site/'s keyed-label eyebrow on a hairline.

The cards move to web/components/settings/ rather than into the page, which
would have made it ~600 lines. That is also where the Field and inputClass
pair now lives: the two pages each had a byte-identical copy, and folding
them together is exactly when three copies would have started to drift.

Members and SSO adopt SectionCard, which the rest of the page already used.
A card that kept its own header treatment would read as a different kind of
thing rather than another setting, which is the problem being fixed.

next.config.ts keeps a permanent redirect from the old path, so bookmarks
and any support reply linking it still land somewhere useful.

claude.md

@@ -528,7 +528,17 @@ Customer nav is three destinations — Overview, People, Billing. Settings is in
 | `/monitors`, `/monitors/new`, `/monitors/[id][/edit]`           | Checks, uptime, incidents                                               |
 | `/secrets`, `/secrets/[group]`                                  | Vault                                                                   |
 | `/audit`                                                        | Audit log                                                               |
-| `/settings`, `/settings/org`, `/settings/notifications`         | Alerts, members, OIDC, channels                                         |
+| `/settings`, `/settings/notifications`, `/settings/license`     | Members, OIDC, alerts, retention, ESO token · channels · licence        |
+
+**`/settings` is one page, not a section.** Members and single sign-on used to
+live at `/settings/instance` with their own sidebar entry; they are now the
+**Access** group at the top of `/settings`, above **Monitoring** and
+**Integrations**. Splitting "who can sign in" away from "how this instance
+behaves" made two half-pages and a nav entry called Instance that no one could
+distinguish from Settings. `next.config.ts` keeps a permanent redirect from the
+old path. The cards live in `web/components/settings/` rather than in the page,
+which is also where the `Field`/`inputClass` pair the three of them share now
+lives — one copy instead of the three that existed while they were apart.
 
 ---