Merge main into the teams branch

Two conflicts, and both were two people counting the same things differently
rather than disagreeing about what the code should do.

PhoneShell's header comment. The branch made "the five hub screens"
numberless, because TEAMS made it six and a number in that sentence had
already gone stale once. Main corrected "three destinations" to "two" in the
same sentence, because giving a shell the whole phone took the terminal out of
the set the header is drawn on. Both are right and neither noticed the other:
the header now stays on the hub's screens and on the two top-level
destinations, which is Hosts and Keychain.

The manual checks. Both sides appended a Phase 10 — main added the software
keyboard and the phone's terminal surface as 10 and 11, the branch added
Teams. Nothing about them overlaps, so the resolution is to keep all three in
the order they were written and renumber Teams to Phase 12, its subsections
and the one cross-reference inside 12.1 with it. Main's two phases keep the
numbers they already carry in its history, since renumbering those would move
headings somebody may already have linked to.

Everything else merged without a conflict, and the two places worth checking
afterwards both held: IsMoreSurface and the first case of
PhoneShell.OnBackRequested each kept ShellScreen.Team alongside main's edits.
Those two are one fact in two places, so a merge that dropped Team from either
would have trapped the user on the teams screen with the MORE tab dark.

Verified after resolving: solution builds with no errors and no new warnings,
the Android head builds, and every suite passes — App 214, Layout 73, Api 162,
Infrastructure 34, Contracts 25, Session 54. App gained the three shell-flow
tests main brought with it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/android-port.md

@@ -509,6 +509,14 @@ go at 360dp:
    drawn, because a modifier that is on and does not look on is how somebody sends `^L` to a database prompt
    believing they typed an `l`.
 
+   **The surface has since taken the whole screen.** `PhoneShell` collapses the header, the session strip
+   and the bottom bar while a terminal is showing — one binding on `IsShowingPages` each — and the screen
+   draws a 52-pixel bar in their place: back, the session pills, and a `+` raising a sheet with the three
+   connections there are. That sheet is the head's first control that could be drawn over the renderer, so
+   it collapses it rather than covering it, exactly as the desktop's palette does; whether Android's
+   WebView actually composites above Avalonia content is still the unverified question recorded below, and
+   collapsing is correct under either answer.
+
 All eight are done for the decided scope, and v2 has since gone past it — see the note under step 7.
 
 What is left, in the order it matters:
@@ -564,3 +572,16 @@ Recorded so they are choices rather than accidents. Any of them is cheap to revi
 - **`NativeKeyboardFocus` is not ported.** It exists for a documented Win32 asymmetry — focus crosses into
   WebView2 but does not come back — and Android's focus model is different enough that the problem should be
   confirmed to exist before anything is written to solve it.
+- **The software keyboard is kept off the interface in one place, and by two mechanisms.** `PhoneShell`
+  owns it rather than each screen, because everything the phone draws is inside that one control and a
+  screen added later would otherwise have to remember. The two mechanisms are not a belt and braces: before
+  Android 15 the activity's `AdjustResize` has the platform shorten the window and the reported keyboard
+  inset arrives already consumed, and from Android 15 edge-to-edge is enforced, the window is no longer
+  resized for the keyboard, and the inset is what there is. Each is dead where the other applies, which is
+  why the margin is taken from the inset alone — the two added together would strand the interface an
+  entire keyboard too high. See `docs/manual-checks.md` phase 10, which is the only way either is verified.
+- **A box that takes a secret says so twice.** `PasswordChar` is what the screen draws and
+  `TextInputOptions.ContentType` is what the software keyboard is told, and only the second one turns off
+  the suggestion strip and keeps the passphrase out of the IME's learning dictionary. The desktop head
+  needs only the first, which is why the phone's `TextBox.secret` class carries both rather than the two
+  being set per box.