Merge branch 'claude/groups-vault-sharing-e4b154'

# Conflicts:
#	src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.cs

src/DodoSSH.Client.App/Views/HostDrawer.axaml

@@ -565,6 +565,34 @@
 
                 <TextBox Text="{Binding GroupEditorLabel}" PlaceholderText="group name" />
 
+                <!--
+                  ◆ WHICH VAULT THIS GROUP WILL LIVE IN, on the same terms as the host editor's picker
+                  above: asked while adding, hidden where there is only one vault to write to, and never
+                  offered for an existing group, because the vaults are encrypted under different keys and
+                  moving an item between them is a delete and a retype.
+
+                  A group in a shared vault is what gives a team an arrangement rather than a heap: the
+                  people holding that vault's key see the folder, and the hosts inside it inherit its port,
+                  its username and its key.
+
+                  The parent picker below follows it, for the reason the host's group picker follows the
+                  host's vault — a parent in another vault would be a level half the readers cannot resolve.
+                  See VaultViewModel.ShowsGroupEditorVaultChoice.
+                -->
+                <StackPanel Spacing="4" IsVisible="{Binding ShowsGroupEditorVaultChoice}">
+                  <ComboBox ItemsSource="{Binding GroupEditorVaultChoices}"
+                            SelectedItem="{Binding GroupEditorSelectedVault}"
+                            HorizontalAlignment="Stretch">
+                    <ComboBox.ItemTemplate>
+                      <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+                        <TextBlock Text="{Binding Display}" FontSize="12" />
+                      </DataTemplate>
+                    </ComboBox.ItemTemplate>
+                  </ComboBox>
+                  <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                             Text="A group in a shared vault is visible to everybody holding that vault's key, and only hosts in the same vault can be filed under it." />
+                </StackPanel>
+
                 <ComboBox ItemsSource="{Binding GroupEditorParentChoices}"
                           SelectedItem="{Binding GroupEditorSelectedParent}"
                           HorizontalAlignment="Stretch">

src/DodoSSH.Client.App/Views/HostsScreen.axaml

@@ -332,6 +332,17 @@
                         </Grid>
                         <TextBlock Text="{Binding Description}" FontSize="11"
                                    Foreground="{StaticResource TextFaint}" />
+                        <!--
+                          Which vault this group is in, on the same rule and in the same place as the host
+                          card's: only where there is more than one vault to be in. It matters more on a
+                          folder than on a machine — two vaults may each hold a "production", and without
+                          this the cards are two identical folders side by side, one of which a colleague
+                          can read. It is also what says a group is shared at all.
+                        -->
+                        <TextBlock Classes="mono" Text="{Binding VaultBadge}" FontSize="10"
+                                   Foreground="{StaticResource TextFaint}"
+                                   TextTrimming="CharacterEllipsis"
+                                   IsVisible="{Binding HasVaultBadge}" />
                       </StackPanel>
                     </Grid>
                   </Border>