geenforce: move settings into the Settings rail

The client IP allowlist config was a tab inside the GE-Enforce section; move
it to the Settings rail via get_settings_cards (matches printedparts / zabbix /
dell). Route relocated from /geenforce/settings to /settings/geenforce; the
in-section Settings tab is removed. Card: Settings > GE-Enforce.

plugins/geenforce/frontend/routes.js

@@ -24,13 +24,15 @@ export default [
         name: 'geenforce-reports',
         component: () => import('./views/EnforcementReports.vue'),
         meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
-      },
-      {
-        path: 'settings',
-        name: 'geenforce-settings',
-        component: () => import('./views/GeEnforceSettings.vue'),
-        meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
       }
     ]
+  },
+  {
+    // Config lives in the Settings rail (contributed via get_settings_cards),
+    // not inside the GE-Enforce section tabs.
+    path: 'settings/geenforce',
+    name: 'settings-geenforce',
+    component: () => import('./views/GeEnforceSettings.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
   }
 ]

plugins/geenforce/frontend/views/GeEnforceLayout.vue

@@ -7,7 +7,6 @@
     <nav class="section-tabs">
       <router-link to="/geenforce/manifests" class="tab">Manifests</router-link>
       <router-link to="/geenforce/reports" class="tab">Enforcement Reports</router-link>
-      <router-link to="/geenforce/settings" class="tab">Settings</router-link>
     </nav>
     <router-view />
   </div>

plugins/geenforce/plugin.py

@@ -91,6 +91,19 @@ class GeEnforcePlugin(BasePlugin):
             },
         ]
 
+    def get_settings_cards(self) -> List[Dict]:
+        """Admin config for GE-Enforce lives in the Settings rail."""
+        return [
+            {
+                'group': 'GE-Enforce',
+                'to': '/settings/geenforce',
+                'icon': 'shield',
+                'title': 'GE-Enforce Settings',
+                'description': 'Client IP allowlist for token-less fleet access',
+                'position': 46,
+            },
+        ]
+
     def init_app(self, app: Flask, db_instance) -> None:
         logger.info(f"GE-Enforce plugin initialized (v{self.meta.version})")