Desktop: show the right vault's people, leave settings on lock, say when an import fell short, and stop host names being cut to four letters

- Choosing a vault while the screen was busy went through a gate that did nothing, so the members
  panel kept showing the previous vault's people under the new name. The read now starts regardless;
  the selection generation discards answers for an earlier choice.
- Locking or signing out from Settings left the window in settings mode under the lock card, with no
  title bar to drag, minimise or close, and unlock returned to Settings. Leaving the unlocked state
  leaves Settings and closes the members panel; Escape closes that panel before leaving Settings.
- Both importers reported success when the keychain was busy and skipped the batch, or failed partway.
  ImportOutcome now carries refused hosts and why a batch stopped, and the screens say so.
- Host cards: the sync badge took 70 of 214 pixels from the name ("bastion" drew as "bast…", two k8s
  workers both as "k8s…"); it now sits on the address line. Tag chips wrap and trim inside the card.
  Keychain names trim inside their column instead of printing over TYPE, and the Security page's
  caption wraps inside its card.

src/DodoSSH.Client.Shell/ViewModels/ImportViewModel.cs

@@ -22,10 +22,27 @@ namespace DodoSSH.Client.Shell.ViewModels;
 /// </param>
 internal sealed record ImportedHostRequest(HostSecret Host, SshKeySecret? Key, string? KeyPath);
 
-/// <summary>What an import stored.</summary>
+/// <summary>What an import stored, and what it did not.</summary>
 /// <param name="Hosts">Hosts written.</param>
 /// <param name="Keys">Private keys written. Counts files read, not hosts bound to one.</param>
-internal sealed record ImportOutcome(int Hosts, int Keys);
+/// <param name="Refused">Hosts skipped because they would not validate — no hostname, a bad port.</param>
+/// <param name="Failure">Why the batch stopped before the end, or null if it did not.</param>
+/// <remarks>
+/// The last two are what the importing screen needs to not claim a success it did not have. The vault's own
+/// status line says these things too, but it is hidden in settings mode, which is where both importers live.
+/// </remarks>
+internal sealed record ImportOutcome(int Hosts, int Keys, int Refused = 0, string? Failure = null)
+{
+    /// <summary>What to add after the screen's own sentence about what was stored.</summary>
+    internal string Caveats =>
+        (Refused switch
+        {
+            0 => string.Empty,
+            1 => " 1 was skipped because it is not a host this keychain can connect to.",
+            _ => $" {Refused} were skipped because they are not hosts this keychain can connect to.",
+        })
+        + (Failure is { } failure ? $" The import stopped early: {failure}" : string.Empty);
+}
 
 /// <summary>One host an <c>ssh_config</c> offered, as a row somebody decides about.</summary>
 /// <remarks>
@@ -409,7 +426,7 @@ internal sealed partial class ImportViewModel(
             _ => $" {outcome.Keys} private keys came with them, and every host that named one is bound to it.",
         };
 
-        return $"Imported {outcome.Hosts} host(s). They are on the Hosts screen.{material}";
+        return $"Imported {outcome.Hosts} host(s). They are on the Hosts screen.{material}{outcome.Caveats}";
     }
 
     /// <summary>