Sign in to Spelunk servers through Spelunk, and connect straight away from a Spelunk link

A Spelunk route can now say that Spelunk signs the user in. Each connection makes a throwaway Ed25519 key pair in memory, sends the public half with the ticket request ({"signIn":{"publicKey":...}}), and logs in as the account Spelunk names (root when it names none) with that key, over the agent's one-connection sshd. Such a host needs no username, key, credential or typed password: the editor greys the login out and saves none, the password box and sheet stay down, and shells, file transfer and port forwards all take the key and account from the route. The flag is nested in the spelunk object at host schema version 10; hosts without it keep their version-9 bytes.

A dodossh://spelunk/connect link now connects: to the personal vault's host tagged spelunk for that server, or, when a saved host already sends an API key to that Spelunk, to a new sign-in host saved in the personal vault with that key and the spelunk tag (made if missing). Only the first link from a Spelunk opens the editor, pre-filled with sign-in ticked and the tag on, so the key credential is chosen once and never sent to an address no saved host already sends it to.

README.md

@@ -471,12 +471,33 @@ this way; the relay and Spelunk are one choice, and ticking one unticks the othe
   not take, a key whose role is too low, a server outside the key's organisation, an agent that is not
   connected, an agent that could not reach the SSH port or is too old to open terminals.
 
+**Sign in through Spelunk (no SSH key needed)**, the box under the key in the same card, lets Spelunk log
+you in instead of an SSH key or password of the host's own. For each connection DodoSSH makes a throwaway
+Ed25519 key pair in memory and sends the public half with the ticket request, which the API key authorises;
+the agent runs a one-connection `sshd -i` on the server whose only authorised key is that one, and says
+which account it logs in as (`root`). It is real SSH to the server's real host key, so shells, file
+transfers and port forwards all work, and the key is gone with the connection — it is never stored,
+synced or logged. The login and authentication choices are greyed out while it is ticked and saved as
+nothing. The server needs OpenSSH's `sshd` installed (not running, and no open port); an agent too old
+to sign in, or a server without `sshd`, is said so. Such a host is written at host schema version 10,
+so a DodoSSH older than this shows it read-only.
+
 **"Open in DodoSSH" in Spelunk** starts DodoSSH with a `dodossh://spelunk/connect?api=…&server=…&name=…&host=…`
-link, or hands the link to the copy already running. The link never carries a credential. If a saved host
-already reaches that server through that Spelunk, DodoSSH connects to it; otherwise it opens the host editor
-filled in for a new Spelunk host — name, address, API and server — and you choose how to log in and which
-credential holds the key, and save. Nothing is ever connected that you have not saved, and a link that
-arrives while the vault is locked waits for the unlock.
+link, or hands the link to the copy already running, and **connects straight away.** The link never
+carries a credential. The hosts links make live in your personal vault, tagged `spelunk`:
+
+- If your personal vault has a host tagged `spelunk` for that server on that Spelunk, DodoSSH connects to it.
+- Otherwise, when a saved host already sends an API key to that same Spelunk, DodoSSH saves a new host in
+  your personal vault — named as the link names it, at the link's address (or `spelunk-<server id>`), port
+  22, signing in through Spelunk with that same key credential, tagged `spelunk` (the tag is made if the
+  vault has none) — and connects to it. It syncs like any host you saved yourself.
+- **The first link from a Spelunk** opens the host editor instead, filled in the same way with sign-in
+  ticked and the tag on, and you choose the credential holding that Spelunk's API key once and save. Every
+  later link from that Spelunk connects straight away. A link can be sent by anything on this machine, so
+  an API key is never sent to an address that no saved host already sends it to.
+
+A host you set up by hand, or one in a team's vault, is left as it is: a link for its server adds a host of
+its own. A link that arrives while the vault is locked waits for the unlock.
 
 The Windows installer registers the scheme for your user and removes it on uninstall, the macOS bundle
 declares it in its `Info.plist`, and the Linux package's desktop entry declares `x-scheme-handler/dodossh`.