Merge branch 'main' into claude/m3-implementation-57f9d7

Three files conflicted, and two of the resolutions are more than a choice of
side.

QuickConnectTests had both branches fixing the same build break — main's M2
merge left the shell's constructor with an ISftpSessionFactory nobody passed.
Main's version wins because it carries a comment saying why the palette never
needs a session.

VaultSession's conflict is adjacent edits: main added the remembered sign-in
members and this branch changed SyncAsync's summary from "the active vault" to
"one vault". Both kept.

VaultViewModel is the one that matters. Main taught the background pass to
report a sync that had to start over, on the grounds that a machine which
silently re-read a whole vault has had something happen to it; this branch
turned a pass into one report per readable vault. Taking either side alone
would have lost the other, so ResyncedFromStart is now one of the conditions
IsWorthReporting checks, per vault.

Merging also broke something neither branch could have caught alone, and the
build would not have said a word. SyncOnceAsync cleared LastSyncFailed
unconditionally, which was right while a pass was one vault and a failure was
an exception that never reached that line. A failure is now a report — one
unreachable team vault must not stop the others syncing — so the flag was being
cleared over a vault that had just failed, lighting the titlebar SYNCED. It is
computed from the report instead, in the one place both callers go through, so
the manual command gets it as well as the loop. The background pass still
swallows the message and keeps the fact, which is what
AnAutomaticPassThatFails_LeavesTheStatusAlone is there to hold it to.

Two comments the auto-merge left describing a world with one vault in it: the
SCOPES rail's, which said team vaults are refused by the access service, and
the host sidebar's "One heading, for one vault".

src/DodoSSH.Client.Session/VaultSession.cs

@@ -96,6 +96,7 @@ public sealed partial class VaultSession : IAsyncDisposable
         Conflicts = new ConflictStore(caches, protector, clock);
         Vault = new VaultStore(caches, clock);
         Unlock = new UnlockStore(caches, clock);
+        SignIn = new RememberedSignInStore(caches, protector, profile.UserId, clock);
         Hosts = new HostRepository(Items, Outbox, keyring);
         SshKeys = new SshKeyRepository(Items, Outbox, keyring);
         Credentials = new CredentialRepository(Items, Outbox, keyring);
@@ -169,6 +170,51 @@ public sealed partial class VaultSession : IAsyncDisposable
     /// </remarks>
     internal UnlockStore Unlock { get; }
 
+    /// <remarks>
+    /// Only reachable from an open session, which is the point rather than an accident of where it was
+    /// put: the token is sealed under this session's cache key, so a locked machine cannot read it and
+    /// therefore cannot reach the server at all. See <c>RememberedSignInStore</c>.
+    /// </remarks>
+    internal RememberedSignInStore SignIn { get; }
+
+    /// <summary>
+    /// Remembers the sign-in this machine currently holds, so a later launch can resume it.
+    /// </summary>
+    /// <param name="refreshToken">
+    /// The refresh token the connection holds <em>now</em>. Providers rotate these, so a caller that
+    /// notices a change has to call this again — the value is not a constant for the life of a sign-in.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    public Task RememberSignInAsync(string refreshToken, CancellationToken cancellationToken)
+    {
+        ObjectDisposedException.ThrowIf(disposed, this);
+
+        return SignIn.SaveAsync(refreshToken, cancellationToken);
+    }
+
+    /// <summary>
+    /// Reads the sign-in this machine may resume, or null when there is none to resume.
+    /// </summary>
+    /// <remarks>
+    /// Null covers three situations that are one situation from the caller's side — nothing was ever
+    /// remembered, the record was written under a different identity, or its tag no longer verifies — and
+    /// the answer to all three is the same: sign in through the browser.
+    /// </remarks>
+    public Task<string?> ReadRememberedSignInAsync(CancellationToken cancellationToken)
+    {
+        ObjectDisposedException.ThrowIf(disposed, this);
+
+        return SignIn.ReadAsync(cancellationToken);
+    }
+
+    /// <summary>Forgets the remembered sign-in.</summary>
+    public Task ForgetSignInAsync(CancellationToken cancellationToken)
+    {
+        ObjectDisposedException.ThrowIf(disposed, this);
+
+        return SignIn.ForgetAsync(cancellationToken);
+    }
+
     /// <summary>Runs one synchronisation pass over one vault.</summary>
     /// <param name="api">The transport. Supplied per call because a session outlives any one connection.</param>
     /// <param name="vaultId">The vault to sync.</param>