Settings and Retention polish found during Task 7419

Small UX gaps seen while testing Settings knobs and the org Retention form (Task 7419): 1. The org retention refusal from the API (`app/org_retention.py::refusal`) still says "leave it empty to keep the default (N days)" even when N is past the allowed range; word it like the form's hint ("Empty keeps the platform's N days"). 2. The Retention form's intro line "Empty keeps the platform default." now repeats every field's hint; drop it or keep only "Older data is deleted for good each night." 3. `operator_settings` validation sentences open with the raw knob key (`must be >= 1`); other callers (Orgs › <org> › Settings) still show the key. Word them by label server-side so every console surface reads the same. 4. On desktop the save refusal alert sits above the search row, a screen away from a refused row low in a long category; scroll the refused row into view on refusal (Task 7263's row line is already there). 5. The customer Security tab is a long page (IP allowlist, SIEM, Retention, MicroVM, Size…); add a sticky jump list or highlight the section in view (item 7 of Task 7419, declined there). Out of scope: retention rules, the nightly sweep, Settings › Providers. Done means: - Each item shipped or declined with a one-line reason; screenshots of the affected surfaces at desktop and 375px. Required checks: ./dc check full

Shipped 1, 2, 3 and 5. Item 4 was already shipped by Task 7263 and verified live. Quick gate green; PR #6043 merged. Its own deploy failed (other tasks' migration clash); the newer dev deploy carrying it applied. Checked desktop and 375px. Filed draft #7496.