Stop making people wait for a handshake, and give the host list a pointer

Connecting held the vault's busy gate, which meant a window that did nothing visible for
as long as a machine took to answer — and against one that is merely asleep, that is the
whole timeout. The gate is gone from that one command. A tab now appears in the strip in
the same turn as the click, carrying "connecting…" rather than a pane, and the terminal's
rectangle draws a card naming the host and the address being dialled. Every other screen
stays usable, and two connections can be in flight at once.

That splits the vault's one connection event into three, carrying an attempt id, because
"which tab is this about" can no longer be answered by "the most recent one". The id also
buys the two kinds of not-connecting their different endings: a refusal stays in the strip
as a tab holding its reason, since by then the user is quite likely three screens away and
a status line they are not looking at is not where a failure should end; a host key
question takes the tab away and puts the window back on HOSTS, because the prompt is drawn
there and a tab claiming failure would be competing with the thing about to resume it.

ConnectAsync takes no CancellationToken any more, and that is load-bearing rather than
tidying. A [RelayCommand] over a method that takes one generates a command that cancels
the previous execution's token on every invocation — so asking for a second machine
silently abandoned the first, measured as the first tab disappearing with "Cancelled." the
instant the second was asked for. Giving up on a connection is closing its tab, and a
session that lands after that is adopted rather than dropped: a shell running with nothing
naming it cannot be closed at all.

A tab is marked active on IsShowing rather than IsSelected. The selection survives
navigating away — that is what makes the strip a way back to a terminal instead of a way
to lose one — so a tab lit while preferences filled the window was a second "you are here"
mark pointing at something nobody could see. The nav rail's own entries have always made
this distinction.

The host list grows the two gestures it looked like it already had. A right click selects
the row under the pointer before opening a menu of Connect, Edit and Delete — the menu is
on the list rather than in the item template, so its entries are the vault's own commands
and not a row's, and it is cancelled outright over a group heading. Dragging a host onto a
heading files it there, onto a host files it beside that one, and onto UNGROUPED takes it
out of a group; the write is one field of one host through the same repository a save
uses, refused while the editor is open because a drop is a gesture on the list and not on
a half-typed form.

Clicking a result in the palette connects, which is what a list of hosts under a search
box looks like it does. It went through the shell's own command, so the pointer and Enter
take one path.

And the files screen's two pickers followed the vault's lists once, at unlock: a host or a
bucket created afterwards could not be picked until the keychain had been locked and
opened again, with nothing on screen explaining why the machine plainly in the host list
was missing. They follow the collections now, re-finding the selection by id across the
rebuild a sync pass causes every minute.

165 shell tests and 69 layout tests green, including the connecting tab, both failure
endings, two connections at once, a connection in flight across a lock, and the right
click acting on the row under the pointer rather than on the selection. The drag itself is
in docs/manual-checks.md with the rest of phase 7 — headless Avalonia has no platform
drag, and a test that claimed to have dropped something would pass while confirming
nothing.

src/DodoSSH.Client.App/Views/TerminalTabs.axaml

@@ -56,23 +56,39 @@
                 event handled — so a left press on the cross does not also select the tab. It deliberately
                 does not handle any other button, which is exactly what lets a middle press bubble out of
                 the cross and reach the handler below.
+
+                Marked active on IsShowing rather than on IsSelected, which are not the same question. The
+                selection survives navigating away — that is what makes the strip a way back to a terminal —
+                so a tab lit while preferences filled the window would be a second "you are here" mark
+                pointing at something nobody can see. See TerminalTabViewModel.IsShowing.
               -->
               <Button Classes="flat tab"
-                      Classes.active="{Binding IsSelected}"
+                      Classes.active="{Binding IsShowing}"
                       Command="{Binding $parent[ItemsControl].((vm:MainWindowViewModel)DataContext).SelectTabCommand}"
                       CommandParameter="{Binding}"
                       PointerPressed="OnTabPointerPressed"
                       ToolTip.Tip="{Binding Address}">
                 <StackPanel Orientation="Horizontal" Spacing="7" VerticalAlignment="Center">
                   <!--
-                    Green while the shell behind this tab is running, grey once it has ended. The pane
-                    keeps its scrollback either way, which is usually why somebody is still looking at a
-                    tab whose dot has gone out.
+                    Green while the shell behind this tab is running, grey while it is connecting and once
+                    it has ended. The pane keeps its scrollback either way, which is usually why somebody is
+                    still looking at a tab whose dot has gone out.
                   -->
                   <Ellipse Classes="dot" Width="5" Height="5" Classes.live="{Binding IsLive}"
                            VerticalAlignment="Center" />
                   <TextBlock Text="{Binding Label}" VerticalAlignment="Center" />
 
+                  <!--
+                    What a tab with no pane has to say for itself: "connecting…" while the handshake runs,
+                    and the refusal once one has failed. It is here rather than only on the card because the
+                    whole point of not blocking the window is that the user is somewhere else — the strip is
+                    the one piece of chrome that is on screen wherever that is.
+                  -->
+                  <TextBlock Text="{Binding Status}" VerticalAlignment="Center" FontSize="9.5"
+                             MaxWidth="180" TextTrimming="CharacterEllipsis"
+                             Foreground="{StaticResource TextFaint}"
+                             IsVisible="{Binding !HasSession}" />
+
                   <!--
                     Always drawn, never on hover only. The strip has no other close affordance, and one
                     that appears when the pointer is already over the tab cannot be found by somebody