Directory polish: refused-route feedback, empty overflow

Found while testing Task 7088 in the UI. Each item is a short requirement; skip any already true on develop. 1. A member who opens an org-admin page by link (e.g. `/users/new`) is silently redirected to `/tasks`. Show the no-access screen (or a one-line notice) instead, so a shared link explains itself. 2. `components/Tabs.tsx` mounts its overflow `Menu` with `keepMounted` on every page, so an empty `role="menu"` sits in the DOM when no tab is hidden. Mount it only when there are overflow tabs, and keep hidden tabs' panels labelled. 3. People beside an open user at 1024px still cuts long emails ("dev-group-member@cockpit.l…"). Wrap them, or show the full email on hover, as the 390px list now does. 4. The Git access hint on the user editor says "Add one in Secrets." as plain text. Make "Secrets" a link to `/credentials`. 5. The New account page's breadcrumb says "Brains" while the Directory tab says "Agents". Use one name. 6. In the compact Secrets filter strip (beside an open credential) the Secrets picker's value is cut ("Stored or n…"). Use shorter option labels at that width, or let the strip drop to a third line before cutting text. Out of scope: route guards' server-side checks; `lib/listDetail.ts` split arithmetic; the API. Done means: - Each item ships with a vitest or e2e test, or is declined in the PR with a reason. - Before/after screenshots at 1024px (editor open) and 390px. - `./dc check full` green.

All 6 Directory polish items shipped with vitests in PR #5797 (merged 11df6b356; Jaah Deploy success). Changes: no-access screen on refused links, overflow menu only when needed, whole emails, Secrets link, Machines › Brains trail, short Secrets options. Quick gate green; review lanes pass. Follow-up draft #7134.