Let a key move to another vault, and ask whether it goes with the host

Keys sync and keys are shared: SshKey is in the sync registry on both sides, the
material rides in the sealed payload, and every generation of the vault key is
wrapped to a new member. What was missing was the way in. Hosts and groups could
move between vaults and keychain items could not, so a key typed into a personal
vault before the team existed stayed there for good — and moving a host into the
team's vault left it authenticating with something nobody else in that vault can
read. The code said so and could do nothing about it: "the answer is usually to
put a copy of that key in the destination vault", which meant pasting the private
half into a second item and deleting the first. A private key on a clipboard, and
two items nobody can tell apart afterwards.

MoveAsync already existed on the generic repository and is now exposed for keys
and passwords as it is for hosts and groups. What had to be built around it is the
re-aim. An item re-sealed under another vault's key lands with an id of that
vault's making, so every host bound to the old one and every group lending it as a
default is left naming a tombstone — and a host bound to something its vault no
longer holds refuses to connect rather than falling back to a typed password. A
move without the re-aim would look like a success and break every machine on that
key. It runs over every vault this session can write to, because a binding
resolves across all of them, and it counts what it could not rewrite: an item from
a newer client, or one in a vault this account may only read. Those are said in
the sentence afterwards rather than swallowed.

The host's move asks the question rather than deciding it. A binding resolves
across vaults, so the moved host goes on working for the person who moved it
whichever way this is answered; it is the colleagues they have just joined who
hold one vault's key and cannot connect with a host whose key stayed behind.
Unticked, and it stays that way on purpose: moving a key into a team's vault hands
it to everybody holding that key, and this design does not default anybody into a
disclosure. Under the box is the count of everything else that authenticates with
that key, because a key twenty machines use is a different decision from one
nothing else touches, and neither number is visible from the panel otherwise. The
question is answered against the vault in the picker, so choosing a different
destination re-asks it and a key already in the destination offers nothing.

One thing fixed on the way. A host that inherited its key from its group arrived
in the destination naming nothing at all — the group belongs to the vault it left
— so a machine that connected before the move refused after it, with no sentence
anywhere saying why. The resolved binding is now written onto the host as it
crosses, and the stranded-binding warning reads the resolved binding too, which is
the case where somebody is least likely to know a key is involved.

MOVE is on both heads, for keys and passwords only: a tag, a bucket and a pin are
read from the active vault alone, so "another vault" is not a question any of them
has. Four tests cover the move and its re-aim, the host's move with the key
brought and without it, and the inherited binding.

docs/manual-checks.md

@@ -446,6 +446,31 @@ target lands. Anything still in the source vault is a partial move, which is sur
 not happen with the network up: the groups are written top-down and the hosts last, so an interruption leaves
 hosts behind and never a shelf with nothing on it.
 
+### 3.3b Moving a key, and moving a host with its key · **needs a second vault**
+
+In your personal vault: add an SSH key, then two hosts that both authenticate with it. On the Keychain
+screen select the key and press **MOVE**, and read the panel before choosing the shared vault.
+
+**Pass:** the panel says what uses the key — "Used by 2 hosts…" — before anything happens. Afterwards the key
+carries the destination's badge under an id it did not have a moment ago, *and both hosts still say `key`
+under their names* and still connect. The sentence names the vault and the two hosts that followed it.
+
+Then the other direction: with a key back in your personal vault and a host bound to it, choose **Move to
+another vault…** on the host and pick the shared vault. The tick box under the picker offers to bring the
+key, unticked, with the count of what else uses it underneath. Leave it and press MOVE; then move the host
+back, tick it, and press MOVE again.
+
+**Pass:** unticked, the host lands in the shared vault and the status line says the key it authenticates with
+is in another vault and will not resolve for anybody else there. Ticked, the key lands in the shared vault
+too and the host still says `key`. Choosing a *different* vault in the picker re-asks the question, and the
+box disappears when the destination is the vault the key is already in.
+
+**Failure means:** a host that says `password` after either move is the re-aim not having happened — the item
+takes a new id in the destination, so every host bound to it and every group lending it has to be rewritten
+as it lands, and a host bound to something its vault no longer holds refuses to connect rather than falling
+back to a typed password. A tick box that is ticked when the panel opens is worse than a bug: it moves a
+private key into a shared vault on the strength of a decision nobody made.
+
 ### 3.4 A group deleted on another machine · **needs two machines**
 
 Make a group on machine A, file a host into it, sync. On machine B, sync, then delete the group and sync