Move SFTP and S3 into the tab strip, and the host list into a card grid

Four asks in one pass over the desktop head, and two of them are furniture
moving rather than anything new.

THE STRIP IS THE WINDOW'S NOW, not the terminal's. Vaults, SFTP and S3 sit at
its head and cannot be closed, and open terminals follow them. SFTP and S3 left
the nav rail to get there, which is the one semantic change: they are the two
destinations you stay in while something runs, and a rail entry is for
somewhere you go and come back from. So the rail belongs to the Vaults tab and
collapses with it, which also means SFTP, S3 and a terminal each get the full
1016 rather than the 826 a page gets.

The tab is expressed as "a page, and not one of the two the strip took" rather
than as a fourth ShellSurface. Both are still ShellScreen members and have to
be — that is what they are on the phone, where they are two rows in a hub — so
a surface each would have been a second way to say a thing Screen already says.
IsTransfersShowing and IsBucketsShowing light the other two tabs unchanged.
What is new is one field: the page Vaults comes back to, because it is the one
tab with sub-navigation and therefore the one that can return to the wrong
place. That is not the hidden field ShellSurface argues against — that one
would be a second copy of "which page"; this is a tab remembering its own.

THE HOSTS SCREEN IS A GRID, and the 268-pixel sidebar is gone. That column was
choosing among forty machines and editing one of them at two-thirds width, and
it was narrow so the editor beneath it could be a column at all. Cards took the
first job at full width; a 304-pixel drawer took the second and collapses when
nothing is selected. Pressing a group card narrows the grid; SHOW ALL is the
way back. The group editor moved into the drawer as well, which finally makes
IsEditingGroup mean the same thing on both heads — it was the phone's alone,
because the desktop's editor was a bar that was always on screen.

AreHostsExpanded and ToggleHosts went with the control that used them. They
folded the whole list away under one heading, an affordance that existed
because the column was narrow. Folding a single group is a different thing and
is still here.

THE TYPE SCALE IS A POINT LARGER and the text ramp is white. The base size was
never stated anywhere — a bare TextBlock took TextElement's default of 12 — so
raising the scale meant naming it, on Window and on UserControl. The second
selector is not redundancy: the layout harness hosts a UserControl in a window
it builds itself, and without it the suite would measure every screen a point
smaller than it ships, silently. A selector on TextBlock would have been the
obvious way and is wrong, because a style setter beats an inherited value and
would collapse every deliberate step back to one number.

#E3E7F4 is a blue-tinted white on blue-black surfaces, which costs contrast
twice — once for being darker than white and once for sharing a hue with what
it is drawn on. Pure white is 18.3:1 against the canvas where that was 15.5:1.
Every step below moved with the top, so the intervals the design chose are
kept and TextDim clears 9:1 against 6.4:1. The palette is shared, so the phone
has both changes too.

TWO DEFECTS THE HARNESS STRUCTURALLY CANNOT SEE, found by rendering the screen
rather than by measuring it, and both now covered.

The tile was 232 and was first written as 248, from arithmetic that left out
the scrolling stack's own margins. Every layout test passed — the harness asks
whether a control is inside the window, never how many fit on a line — so the
grid quietly became one column wide at exactly the minimum this application
guarantees, which is the shape cards exist to avoid.
TheHostsGridKeepsTwoColumnsAtTheMinimumWithTheDrawerOpen counts columns
instead, and fails at 248.

And a card's text ran past its own border, because a horizontal StackPanel
measures children with infinite width: a TextBlock inside one never learns it
is short of room, so TextTrimming never fires. Both card rows are grids with a
star column that gives way and an Auto column that does not — a hostname with
its tail cut is still the machine you were looking for, where a badge or the
word naming an auth method is not.

The keychain header changed shape for the same class of reason. It was
Auto,Auto,*,Auto with the buttons last, so the slack column was the only thing
absorbing a change of width and five buttons fell off the right edge the moment
the type grew. That is how GENERATE lost the word KEY once already. The summary
sits in the star column and trims now, so the buttons always get their width.

HostSidebarTests became HostGridTests and moved to the grid with the gestures
it drives. docs/design-import-gaps.md gains a v3 section naming the five
toolbar controls in the design with nothing behind them — a view-mode switch, a
tag filter, a calendar, a share control and Serial — and manual-checks.md and
the README follow the controls that moved.

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -76,33 +76,57 @@
     <Panel Grid.Row="1">
 
       <!-- The unlocked application. -->
-      <Grid ColumnDefinitions="Auto,*" IsVisible="{Binding IsUnlocked}">
-
-        <views:NavRail Grid.Column="0" />
+      <Grid RowDefinitions="Auto,*" IsVisible="{Binding IsUnlocked}">
 
         <!--
-          The rail is full height and the strip is not, so the strip spans exactly the area it navigates.
-          The other arrangement — strip above rail — would put a row of tabs over a column of destinations
-          they have nothing to do with.
+          ◆ THE STRIP IS ABOVE THE RAIL, and it used to be beside it.
+
+          It was the other way round for a reason that stopped being true: while every tab was a terminal,
+          the strip navigated only the area to the right of a full-height rail, and putting it over the rail
+          would have been a row of tabs above a column of destinations they had nothing to do with.
+
+          The three fixed tabs are what changed that. The rail is now one tab's contents rather than the
+          window's own furniture — Vaults owns it, SFTP and S3 do not have it, and a terminal does not
+          either — so a rail drawn beside the strip would outrank the thing that decides whether it is
+          showing at all. Above and full width is the arrangement that matches what selects what.
         -->
-        <Grid Grid.Column="1" RowDefinitions="Auto,*">
+        <views:TerminalTabs Grid.Row="0" />
 
-          <views:TerminalTabs Grid.Row="0" />
+        <Grid Grid.Row="1" ColumnDefinitions="Auto,*">
 
-          <Panel Grid.Row="1">
+          <!--
+            The Vaults tab's own navigation, and it collapses with that tab. Its width is 190 either way, so
+            SFTP, S3 and a terminal each get the full window rather than the 826 a page gets.
+          -->
+          <views:NavRail Grid.Column="0" IsVisible="{Binding IsVaultsTab}" />
+
+          <Panel Grid.Column="1">
 
             <!-- ============ THE PAGES ============ -->
             <Panel IsVisible="{Binding IsShowingPages}">
 
               <!--
-                Bound directly rather than wrapped, unlike the two below it: this screen's data context is
-                the shell's, so IsHostsScreen resolves. It hands the vault to the sidebar from inside its
-                own markup.
+                Wrapped, like every other screen here. It used to be bound directly — its data context was
+                the shell's, so IsHostsScreen resolved on the same element — and that was only so it could
+                hand the vault to the host sidebar from inside its own markup. The sidebar is gone and the
+                drawer that replaced it is a plain child, so the screen takes the vault like the rest and
+                its visibility goes on the wrapper.
               -->
-              <views:HostsScreen x:Name="HostsPane" IsVisible="{Binding IsHostsScreen}" />
+              <Panel IsVisible="{Binding IsHostsScreen}">
+                <views:HostsScreen x:Name="HostsPane" DataContext="{Binding Vault}" />
+              </Panel>
 
-              <!-- ============ FILES ============ -->
+              <!-- ============ SFTP ============ -->
               <!--
+                Inside this Panel although it is a tab rather than a rail screen, and that is not an
+                oversight. IsShowingPages means "the Avalonia page area, not the WebView", which is the
+                occlusion question and is true of all three fixed tabs; which of them is showing is the
+                separate question each child below answers. Keeping the two apart is what lets the terminal
+                stay collapsed under one rule rather than under four.
+
+                What differs from a rail screen is only the rail: NavRail collapses on IsVaultsTab above, so
+                this screen is laid out at the full window width.
+
                 Wrapped rather than bound directly, for the same reason the vault screen is: this element's
                 visibility is the shell's business and its data context is the transfers view model, and
                 putting both on one element resolves IsVisible against that view model, where
@@ -114,10 +138,10 @@
 
               <!-- ============ S3 ============ -->
               <!--
-                The same screen as FILES above, over the same view model, because an object store and an
+                The same screen as SFTP above, over the same view model, because an object store and an
                 SFTP host are both an IRemoteFileStore and everything below the picker was written once.
                 What differs is which picker is offered, and that is decided by the destination rather than
-                by a toggle inside the screen — see ShowFiles, and the sidebar entry that calls it.
+                by a toggle inside the screen — see ShowFiles, and the tab in the strip that calls it.
               -->
               <Panel IsVisible="{Binding IsBucketsScreen}">
                 <views:TransfersScreen DataContext="{Binding Transfers}" />
@@ -266,7 +290,7 @@
               <Border Background="{StaticResource Raised}" BorderBrush="{StaticResource Border}"
                       BorderThickness="1" CornerRadius="6" Padding="14">
                 <SelectableTextBlock Classes="mono" Text="{Binding RecoveryCode}"
-                                     FontSize="16" Foreground="{StaticResource Accent}"
+                                     FontSize="17" Foreground="{StaticResource Accent}"
                                      TextWrapping="Wrap" />
               </Border>
               <CheckBox IsChecked="{Binding RecoveryCodeWrittenDown}"