Merge branch 'claude/gallant-brahmagupta-1f8244'

Writes down that locking the vault leaves shells running, and shows the count on
the unlock screen rather than leaving it to be inferred.

Conflict resolution:

- ShellFlowTests' fixture keeps main's FakeSshConnectionFactory. The branch added
  an IdleSshConnectionFactory for exactly what main's fake already does — a shell
  that is open, silent and never closes on its own — so FakeSshConnections.cs is
  dropped rather than merged, leaving one fake SSH stack in the suite instead of
  two that would drift apart.
- MainWindowViewModel and TerminalWorkspace: both sides added their own members,
  so both are kept.
- TerminalWorkspaceTests was added by both branches, with the renderer gate on
  one side and session lifetime on the other. Merged into one class over one set
  of helpers; the gate tests now use FakeConnectionFactory rather than an
  NSubstitute stub, since the suite already has the fake. gallant's polling
  Timeout constant is PollTimeout, which no longer reads as the renderer's.
- platform-flags.md keeps main's measured focus section and drops the short
  "nothing hands the terminal keyboard focus" entry the branch still carried,
  which that section supersedes.

One genuine disagreement between the branches, left visible rather than
flattened: this branch measured that a collapsed WebView cannot be typed into and
attributed it to a hidden WS_CHILD window being ineligible for keyboard focus,
while main's focus work measured Win32 focus still held by that hidden window and
added a lock path that moves the keyboard off it. Both results stand; the
mechanism sentence now defers to the focus entry, which makes the input barrier
something the lock path maintains rather than something the platform guarantees.

Full suite green, including the container-backed SSH tests.

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -68,7 +68,12 @@
             <Button Content="Sign in" Command="{Binding SignInCommand}"
                     IsVisible="{Binding !IsOnline}" />
             <Button Content="Sync" Command="{Binding Vault.SyncCommand}" />
-            <Button Content="Lock" Command="{Binding LockCommand}" />
+            <!--
+              The tooltip carries the policy to the point of action, because the button's name implies
+              the opposite of what it does to a running shell.
+            -->
+            <Button Content="Lock" Command="{Binding LockCommand}"
+                    ToolTip.Tip="Closes the vault and forgets its keys. Open shells keep running and reappear when you unlock." />
           </StackPanel>
         </Grid>
       </Border>
@@ -319,6 +324,23 @@
             <TextBlock Classes="hint" Text="{Binding StatusMessage}" />
             <TextBlock Classes="hint" FontSize="11"
                        Text="This works with no network: the salt and the wrapped key are already on this machine." />
+
+            <!--
+              Stated here because the lock screen is what hides it. The terminal's WebView is collapsed
+              while locked, so a shell left running is invisible as well as unstopped — and a screen
+              saying "Unlock your vault" over a machine that still holds authenticated SSH channels is
+              exactly the kind of half-truth this project writes down instead of implying. Visible only
+              when there is something to disclose, so an ordinary launch stays quiet.
+            -->
+            <Border Background="#1b2432" CornerRadius="4" Padding="10,8"
+                    IsVisible="{Binding HasLiveSessions, FallbackValue=False}">
+              <StackPanel Spacing="4">
+                <TextBlock Text="{Binding LiveSessionSummary}" Foreground="#bcd2ea"
+                           FontWeight="SemiBold" TextWrapping="Wrap" />
+                <TextBlock Classes="hint" FontSize="11"
+                           Text="Locking closes the vault, not your terminals: a job you started keeps running, and its output is waiting behind this screen. It also means this machine still holds an open, authenticated channel to those hosts — locked describes the vault, not the connections. Quit DodoSSH to end them." />
+              </StackPanel>
+            </Border>
           </StackPanel>
         </Border>