Let the phone delete a host, and move or remove a group

The desktop gained three things the phone did not follow: moving a group to
another vault, the second question asking whether a group's deletion takes its
hosts with it, and — since long before either — deleting a host at all. What
that left was a head whose v3 + can fill a keychain and whose editors can
correct one, with no way to empty either.

The commands could not simply be bound. DeleteGroup and MoveGroup aim at
GroupTarget, which is the selected card or the open group, and the phone has
neither: its list draws headings, and a heading's selection deliberately bounces
back to the host. Called bare on that head they would have returned having done
nothing — a DELETE that appears to have been pressed and has not. Both now take
the row and fall back to GroupTarget for the desktop's menu, and
ConfirmMoveGroupAsync resolves from the panel's own movingGroupId rather than
from the selection, which is also the honester answer on the desktop: what moves
is the shelf the panel was opened on.

The heading's pencil became a menu. Three icons after a chevron, a name, a vault
badge and a count is what would be left of the name at 360dp, so the ⋯ raises
the add sheet's shape carrying Edit, Move to another vault, a rule, and Delete —
the desktop's card menu, in the one idiom this screen already has. It does not
carry Open: the desktop's grid holds one level of the group tree and this list
holds all of it flattened, so there is nowhere to open a group into.

DELETE under a host sits on a row of its own beneath EDIT and MOVE rather than
beside them. A phone has no hover and no tooltip, so where a thumb lands is the
only thing separating a destructive control from an ordinary one. Both questions
take the controls that asked them — ShowsConnectControls, which is the phone's
half of the rule ShowsHostPaneActions already carries for the desktop's drawer —
so DELETE cannot be pressed a second time underneath its own confirmation.

Preferences gained the running version, and the sentence saying this head does
not replace itself and that no DodoSSH server will ever offer one. It reads
Updates.CurrentVersion off the same view model the desktop's UPDATES section
does, over the null channel that reports itself unsupported.

Nothing was needed for the realtime push: it is composed in ServerConnection,
which both heads use.

Seven tests, all phone-shaped — a group acted on with nothing selected, the menu
waved away leaving nothing armed, the ungrouped heading raising none, and the
bar's three states. The rectangles remain unmeasurable for the reason phase 8
gives; the checks for them are 8.10 to 8.13 and 13.6.

docs/design-import-gaps.md

@@ -52,6 +52,9 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference
 > | A 14px rounded inset around the terminal | Not drawn. The renderer is a native child view composited above everything Avalonia draws, so a rounded frame behind it clips nothing. What the design was after comes from the page's own background, which is the design's `#171A26`. |
 > | Instrument Sans / Fira Code | Inter and the system monospace stack, as before and for the same reason — see the note on `MonoFont` in `Palette.axaml`. |
 > | A theme toggle (`☀`) in the header, and the desktop v2's light theme | Omitted. There is one theme by decision, and a switch with one position is a control that does nothing. |
+> | Nothing at all on a group beyond its heading | ◆ **A menu on the heading, which is the second thing on this list the design had no slot for.** The desktop puts Edit, Move to another vault and Delete on the group's own card; this head draws no group cards and has no right-click, so the `⋯` raises the add sheet's shape with the same three entries in the same order — Move above the rule because it is not a deletion, Delete below it. Open is the one entry it does not carry: the desktop's grid holds one level of the tree and this list holds all of it flattened, so there is nowhere to open a group *into*. It was a pencil alone while Edit was the only thing behind it. |
+> | Nothing that removes a host | ◆ **DELETE, on a row of its own under EDIT and MOVE.** A phone has no hover and no tooltip, so where a thumb lands is the only thing separating a destructive button from an ordinary one — full width in the danger colour, below both, is the same arrangement KEYCHAIN uses. The counted question takes the bar's controls in place rather than stacking over them, which is what stops DELETE being pressed a second time under its own confirmation. Until v3 this head could fill a keychain and never empty one. |
+> | PREFERENCES, which v2 draws as a list of settings | ◆ **One setting, one fact, and a paragraph of absences.** The setting is whether this phone may unlock with a fingerprint — see the screen. The fact is the running version, which matters more here than on the desktop: there it sits beside a CHECK NOW that will say whether it is current, and this head does not replace itself at all. What it says instead is where a newer one comes from, which is ADR 0011 rule 2 in plain words — never from the server you sign in to. |
 > | TERMINAL's empty state: a sentence saying nothing is open | ◆ **More than the design asked for, which is rare enough on this list to say out loud.** The tab is called **Connections** and with nothing running the screen is where one is made: a box taking `user@host` or `user@host:port` with a password, and the machines most recently connected to underneath it, read from the vault's own connection log. The box is the only path in the product to a machine that is not in the keychain — the design assumes every connection starts from a saved host, and the case it has no answer for is an address somebody was handed five minutes ago. Nothing typed there is saved, and the screen says so. |
 >
 > ## The desktop's v2