Make the vault the thing you share, and ask a host which one it lives in

The teams screen listed teams that owned vaults, so sharing four servers with two
colleagues meant creating a team, then a vault inside it, then wrapping a key.
Two of those three steps are about a concept nobody arrives wanting. The screen
now lists vaults: naming one creates the membership list that carries it, named
after the vault and owned by you, and members, invitations, roles, hand-over and
key holders all hang off the vault they apply to.

Nothing on the server moved. VaultAccessService still resolves a shared vault
through team_membership and every membership call still names a team id — what
went is the requirement that anybody make one. The split the whole design rests
on is untouched and is still what the screen is built around: adding somebody
authorises the server to serve them, and only a machine holding the key can make
the vault readable. ADR 0009 keeps its decision and gains an addendum recording
which half of it a person is now asked about.

The one place the team resurfaces is a membership list carrying several vaults,
which this screen cannot produce and does not hide: the members section says so,
because "adding somebody here adds them there" is precisely the fact a
vault-shaped screen is in a position to conceal.

Two things left the interface and one arrived. Creating a team is gone, and so is
archiving one — it was only ever possible for a team owning no vaults, and a
screen whose rows are vaults has no row for one, so the button would have been
unreachable or always refused. The endpoint is unchanged and the screen states
the limit instead, since a vault cannot be deleted at all. The exception is a
create whose second call failed: cancelling that form archives the membership
list it left behind, which is a deliberate departure from this client's rule
against tidying up on the user's behalf, made because nothing else can reach it.

What arrived is PUT /api/v1/vaults/{id}. Without it the screen loses its only
editing action, since renaming the team behind a vault is invisible to everybody
who was never shown the team. It is gated on PermissionFlags.Admin — the line
UpdateTeamEndpoint already draws, because a name is what everybody in the vault
sees it called rather than part of its contents — and it renames the owning team
with it when that team carries nothing else, so the row an operator reads and the
name a user says cannot drift apart. The slug never moves, for the reason it does
not move on a team rename. The session edits its cached vault row rather than
replacing it with the response, which deliberately carries no wrapped key.

The host editor now asks which vault a host goes into, beside the name, while
adding and only where there is more than one vault to write to. It is a second
picker rather than the keychain screen's reused, and the two selections are
separate on purpose: that one is a standing preference about where new items go,
this is a field of the host in front of you, and binding both to one selection
would mean a click on the other screen could move a half-typed host. An existing
host is not offered it at all rather than offered it disabled — the two vaults
are encrypted under different keys, so moving an item is a delete and a retype.

That forced a fix worth naming. The group picker was built from the active
vault's groups whatever vault the host was being filed into, so a host put in a
shared vault could be filed under a group only its author can resolve — a
colleague would see it filed under nothing, which is the quietest kind of wrong.
Groups are now kept per vault and the picker follows the vault choice.

Two renames, because the pair they would otherwise have made is a bug farm:
ShellScreen.Vault became Keychain and VaultScreen became KeychainScreen, which is
what the rail has always labelled that screen, leaving Vault for one vault's
contents and Vaults for the vaults themselves. The enum values are unchanged;
NavRail.axaml writes them as x:Static literals.

1536 tests pass, seven more than before. Five are new on the server — the rename
endpoint's success, the team it does and does not take with it, the two refusals
and the empty name — and the client suite gains six and folds four together,
having lost the two about archiving a team.

src/DodoSSH.Client.App/Views/HostDrawer.axaml

@@ -49,11 +49,16 @@
     hosts screen is a sibling of the WebView. See MainWindow.axaml's occlusion rule.
 
     ── WHAT THE DESIGN DRAWS HERE AND THIS PANE HAS NOT GOT ─────────────────────────────────────────────
-    Share this host, Add Telnet, "SSH ID, Certificate, FIDO2", the backspace-key mapping row and the vault
-    picker's chevron. Five controls with nothing behind them: sharing is per vault and not per item, every
-    session here is an SSH channel, there are no identity or certificate item types, nothing carries a
-    terminal setting to the renderer, and an item cannot be moved between vaults at all. They are listed in
-    docs/design-import-gaps.md with what ships instead, and none of them is drawn disabled.
+    Share this host, Add Telnet, "SSH ID, Certificate, FIDO2", and the backspace-key mapping row. Four
+    controls with nothing behind them: sharing is per vault and not per item, every session here is an SSH
+    channel, there are no identity or certificate item types, and nothing carries a terminal setting to the
+    renderer. They are listed in docs/design-import-gaps.md with what ships instead, and none of them is
+    drawn disabled.
+
+    The design's fifth missing control was the vault picker's chevron, and half of it now exists: a host
+    being *created* is asked which vault it goes into, in the editor below. What still does not exist is
+    the other half — moving an existing host — because the two vaults are encrypted under different keys,
+    so that is a delete and a retype rather than an edit.
   -->
 
   <Border Width="304" Background="{StaticResource Sidebar}"
@@ -66,10 +71,11 @@
         One row for all three panels, which is why what it says is on the view model rather than repeated
         three times here. See VaultViewModel.DrawerTitle.
 
-        The subtitle is the keychain this host is filed in, and the design's chevron beside it is not drawn:
+        The subtitle is the vault this host is filed in, and the design's chevron beside it is not drawn:
         an item cannot be moved between vaults — the two are encrypted under different keys, so moving one
         is a delete and a retype — and a picker offering the move would be offering something no layer below
-        this can do.
+        this can do. Choosing the vault at the moment a host is created is a different question and does
+        have an answer; it is in the editor, beside the name.
       -->
       <Border Grid.Row="0" Padding="14,10" Background="{StaticResource Panel}"
               BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
@@ -358,6 +364,35 @@
 
                 <TextBox Text="{Binding EditorLabel}" PlaceholderText="name" />
 
+                <!--
+                  ◆ WHICH VAULT THIS HOST WILL LIVE IN, asked here because it is the one decision on this
+                  form that cannot be changed afterwards: the vaults are encrypted under different keys, so
+                  moving an item between them is a delete and a retype. It is a field of the host rather
+                  than the keychain screen's standing "new items go to" preference, and it is a separate
+                  selection from it — moving this one does not move that one, and a click over there cannot
+                  move a host half-typed here.
+
+                  Shown only while adding, and only where there is more than one vault that can be written
+                  to. An existing host's row is not drawn at all rather than drawn disabled; the drawer's
+                  header already says where the host is filed. See VaultViewModel.ShowsEditorVaultChoice.
+
+                  The group picker below follows it: a group is an item in one vault, so choosing a vault
+                  refills that list with that vault's groups and clears what was chosen from another's.
+                -->
+                <StackPanel Spacing="4" IsVisible="{Binding ShowsEditorVaultChoice}">
+                  <ComboBox ItemsSource="{Binding EditorVaultChoices}"
+                            SelectedItem="{Binding EditorSelectedVault}"
+                            HorizontalAlignment="Stretch">
+                    <ComboBox.ItemTemplate>
+                      <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+                        <TextBlock Text="{Binding Display}" FontSize="12" />
+                      </DataTemplate>
+                    </ComboBox.ItemTemplate>
+                  </ComboBox>
+                  <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                             Text="A host in a shared vault is readable by everybody holding that vault's key, and it cannot be moved out afterwards." />
+                </StackPanel>
+
                 <!--
                   Which group this host is filed under. Inside the encrypted payload like everything else
                   here, so the server learns nothing about how the estate is organised — and a group the