Add a new Users tab to remote `view` mode that groups per-process metrics
across every scraped host so operators can answer "who is using the
cluster and how much?" at a glance. Accessed via `V` or tab cycling.

Columns: USER, NODES, GPUs, PROCS, VRAM, POWER*, LONGEST, CMD.
POWER* is a VRAM-weighted approximation of the per-user power share,
clamped to >= 0 and marked in the header.

In-tab keys: `u/m/p/n/t` sort, `f` hide system accounts, `e` export to
`~/.cache/all-smi/users-<timestamp>.csv`, `Enter` drill-down per-host
(second Enter drills into processes on that host), `ESC` backs out.

Mode precedence: filter-edit (#186) > replay timecode (#187) > Users-tab
keys > global navigation > replay-mode keys. Users-tab keys intercept
before the outer match so `m/u/p/f` on the tab switch the users-sort key
rather than falling through to the global GPU-sort bindings.

Partial-coverage chip surfaces when only a subset of hosts emit the
`all_smi_process_*` families; hosts with no process rows still count
toward the denominator. Replay frames feed through
`ParsedProcessRow::from_local_process` so recorded sessions render the
tab identically to live scrapes.

Mock hosts emit synthetic processes when `ALL_SMI_MOCK_PROCESSES=1`,
following the same env-var convention as `ALL_SMI_MOCK_VGPU`.

Closes #189

Address findings from the security review of the Users tab introduction:

CSV export (src/view/event_handler.rs):
- Replace std::fs::write with OpenOptions + O_NOFOLLOW + 0o600 (Unix) /
  share_mode(0) + create_new (Windows) so a pre-planted symlink at
  ~/.cache/all-smi/ or the final CSV path cannot redirect the write to
  an attacker-chosen location. Mirrors the hardening already in
  snapshot/record/doctor.
- Refuse to proceed when the cache dir itself is a symlink, closing the
  gap where create_dir_all no-ops on an existing symlinked directory.
- Extend csv_escape with an OWASP CSV-injection guard: fields whose
  first character is =, +, -, @, TAB, or CR are quoted and prefixed
  with a single quote so Excel / LibreOffice / Google Sheets do not
  evaluate them as formulas.
- Add regression tests for symlink refusal, 0o600 file mode, RFC-4180
  quoting, and leading-character injection vectors.

Process metric exporter (src/api/metrics/process.rs):
- Cap command, name, and user label values at 256 / 128 / 128 bytes
  with a UTF-8-safe truncation helper that appends
  "...(N bytes truncated)" so the truncation is visible to operators.
  Mitigates both scrape-response amplification (long argv × 3 metric
  families × N processes × M hosts) and the privacy risk of API
  tokens / DB URLs on command lines being broadcast to every
  Prometheus consumer.

Remote metrics parser (src/network/metrics_parser.rs):
- Apply matching 256 / 128-byte caps to the command / name / user /
  gpu_uuid fields inside process_process_metrics so a malicious remote
  host that bypasses our exporter cannot inflate the per-host process
  accumulator to ~150 MB (1024-byte generic cap × 50 000-row cap × 3
  families). Truncation honours UTF-8 boundaries.

Users aggregator (src/ui/aggregation/user.rs):
- Collapse the double-HashMap-lookup pattern in aggregate_users and
  UserScratch::absorb into a single entry(...).or_insert(0) + &mut
  accumulation, eliminating ~5 000 redundant hashes + string clones
  per scrape tick on a 100-node cluster.
- Pre-size total_vram_by_gpu from the combined GPU count across all
  snapshots to remove rehash allocations on the hot path.
- Add an ignored adversarial stress test (10 hosts × 50 000 rows =
  500 000 rows) to catch future quadratic regressions; release-mode
  completion measured at ~0.5 s.

…artial chip

Addresses five pr-reviewer findings on the Users tab (issue #189):

- F1 (CRITICAL): A second `Enter` on the per-host table now renders the
  full process list for `(drill_user, drill_host)`, matching the
  issue-#189 spec. Before this, `drill_host` was set but nothing was
  drawn, leaving the operator stuck on the per-host view. ESC peels
  back one level at a time: first clears `drill_host` (return to
  per-host table), then clears `drill_user` (return to top table).

- F3: Split the single `data_version` counter into two. `data_version`
  now covers "any UI dirtiness" so the render loop wakes on sort /
  filter / drill key presses, while the new `collector_data_version`
  only advances when collectors push fresh data. The Users-tab
  aggregation cache keys on the collector counter, so typing a sort
  hotkey no longer re-groups the 5 000-row cluster on every keystroke.

- F4: Partial-coverage chip false-triggered on idle-but-configured
  hosts (connected, `--processes` enabled, zero processes running).
  `HostSnapshot` now carries an `is_connected` flag; a host counts as
  "reporting" when it has processes OR is connected. Only genuinely
  disconnected hosts drag the chip denominator down.

- F5: Replays of local recordings collapsed every GPU onto
  `gpu_index = 0` because local readers don't populate the `index`
  detail key. Aggregation now falls back to the GPU's positional
  order within its host-group when the detail key is absent.

- F6: Banner height above the Users-tab body is now computed
  dynamically from the number of visible chips (summary + optional
  partial chip + optional export toast + header), instead of the
  hardcoded approximation that sometimes ate a row from the body.

Tests added:
- `users_tab_enter_twice_drills_into_per_host_processes` (F1)
- `users_tab_sort_keypress_does_not_invalidate_aggregation_cache` (F3)
- `idle_connected_host_is_not_flagged_as_partial` (F4)
- `users_aggregation_assigns_positional_gpu_index_when_detail_missing` (F5)

All existing tests still pass: 764 lib + 879 bin + 3 integration.
Clippy + fmt clean.