Draw what authenticated, and over what, on the session status bar

The v5b design's own row: the negotiated cipher, then the host key's algorithm
and the name of the key or credential that authenticated, as one mono run
beside CONNECTED — on both surfaces, off MainWindowViewModel's surface-aware
SessionCipher and SessionIdentityText, the same shape SessionAddress set.

The identity's name comes out of TryBuildAuthentication, the one resolution
point that always had it in scope and always threw it away; it rides
HostAuthentication to the tab and to the SFTP connect alike. Three deviations,
recorded in the gaps doc: the algorithm prints as negotiated rather than
shortened, the run is plain text because no pin-details modal exists for an
open session, and a typed password shows the algorithm alone — there is no
item behind the dot. A dead terminal tab keeps its facts for the scrollback
still on screen; an SFTP disconnect, with no scrollback, clears them.

src/DodoSSH.Client.Shell/ViewModels/TerminalTabViewModel.cs

@@ -28,10 +28,11 @@ internal enum TerminalTabState
 /// </summary>
 /// <remarks>
 /// <para>
-/// A tab is a session id and two strings. It holds no terminal and owns nothing: the pane, its scrollback
-/// and the shell behind it all live in the renderer and in <c>TerminalWorkspace</c>, and selecting a tab is
-/// one frame telling the page which pane to show. That is what makes tabs cheap here — the expensive object
-/// is the WebView, and there is one of those however many tabs are open.
+/// A tab is a session id and a handful of strings — the address, and now the three connection facts the
+/// status bar draws beside CONNECTED. It holds no terminal and owns nothing: the pane, its scrollback and the
+/// shell behind it all live in the renderer and in <c>TerminalWorkspace</c>, and selecting a tab is one frame
+/// telling the page which pane to show. That is what makes tabs cheap here — the expensive object is the
+/// WebView, and there is one of those however many tabs are open.
 /// </para>
 /// <para>
 /// <b>A tab starts before its session does.</b> Connecting is a network round trip that can take as long as
@@ -102,6 +103,31 @@ internal sealed partial class TerminalTabViewModel : ObservableObject
     /// </remarks>
     internal DateTimeOffset? StartedAt { get; set; }
 
+    /// <summary>
+    /// The negotiated server-to-client cipher, for the status bar — or null while there is no session.
+    /// </summary>
+    /// <remarks>
+    /// Set alongside <see cref="StartedAt"/>, from the same event, and kept for the same reason: a dead tab's
+    /// pane still holds the scrollback of a session that really did negotiate this cipher, and clearing the
+    /// fact when the shell ends would not make it less true of what is on screen.
+    /// </remarks>
+    internal string? Cipher { get; set; }
+
+    /// <summary>The accepted host key's algorithm, e.g. <c>ssh-ed25519</c> — or null while there is no session.</summary>
+    /// <remarks>See <see cref="Cipher"/>; set and kept the same way, for the same reason.</remarks>
+    internal string? HostKeyAlgorithm { get; set; }
+
+    /// <summary>
+    /// The display name of the key or credential that authenticated, or null when a typed password did, or
+    /// null while there is no session.
+    /// </summary>
+    /// <remarks>
+    /// Three different reasons collapse to the same null, and that is deliberate: nothing downstream needs to
+    /// tell a session with no identity to name apart from a tab that has not opened one yet — both mean the
+    /// status bar shows the host-key algorithm alone, with no ` · name` after it.
+    /// </remarks>
+    internal string? IdentityLabel { get; set; }
+
     /// <inheritdoc cref="TerminalTabState" />
     [ObservableProperty]
     private TerminalTabState state;