Fill in the Spelunk API key on the Security page, as a synced Spelunk key that goes only to its own address

Settings → Security gains a SPELUNK section: an API address and a key, saved as a new keychain item, a Spelunk key (SyncEntityType 14, AadResourceType 17, server table spelunk_key via the AddSpelunkKeyItem migration). It is ciphertext only on the server, lives in the personal vault, syncs like every secret, and holds the key together with the one address it may be sent to. The key box empties once saved; the list shows name, address and how many hosts use each key, never the key. Saving a key for an address that already has one replaces it, and deleting goes through the shared confirmation card with the hosts that would stop connecting.

A host's route names a saved key where it named a credential, in the same apiKeyCredentialId field, so no host schema changes and an older build reads such a host as one whose key credential has gone. At connect a saved key is sent only to its own address; a host naming it with another Spelunk address is refused in words. Keys kept as a credential's password still work. The editor offers saved keys first and picks the one saved for an address as it is typed.

A link from a Spelunk with a saved key now connects straight away, including the first one: saving the key is the user's say-so that the first-link editor used to ask for.

The address and key merge as one pair, so two concurrent edits can never pair one device's key with another's address, and the key never reaches the conflict log.

README.md

@@ -456,15 +456,21 @@ phone runs forwards too, listed behind a `⇄` in its terminal's bar, but cannot
 
 A server managed by Spelunk runs Spelunk's agent, which keeps a connection open to Spelunk. DodoSSH can use
 that connection instead of dialling: tick **Connect through Spelunk** in the host editor and fill in
-Spelunk's API address, the server's id in Spelunk, and the credential that holds your Spelunk API key. A
-connection then asks Spelunk for a ticket, opens a WebSocket, and the agent connects to the SSH server on
-the machine's own loopback — so the server needs no open SSH port at all. Shells and file transfers both go
-this way; the relay and Spelunk are one choice, and ticking one unticks the other.
+Spelunk's API address, the server's id in Spelunk, and your Spelunk API key. A connection then asks Spelunk
+for a ticket, opens a WebSocket, and the agent connects to the SSH server on the machine's own loopback — so
+the server needs no open SSH port at all. Shells and file transfers both go this way; the relay and Spelunk
+are one choice, and ticking one unticks the other.
 
-- **The API key is an ordinary keychain credential** — paste the key (`spelunk_…`, with the Admin role) as a
-  credential's password. It is encrypted, synced and rotated like every other secret, one credential serves
-  every server in that Spelunk organisation, and it is sent to the host's API address and nowhere else.
-  The API address must be `https://`, except for a Spelunk on this machine.
+- **Fill in the API key once, under Settings → Security → Spelunk.** Give Spelunk's API address and paste
+  the key (`spelunk_…`, with the Admin role). It is saved as a *Spelunk key* in your personal vault —
+  encrypted, synced to your other devices, never shown again — together with the address, and **it is only
+  ever sent to that address**: a host that names the key with any other address is refused at connect. One
+  key serves every server in that Spelunk organisation; saving a key for an address that already has one
+  replaces it, and every host using it connects with the new key. The host editor offers saved keys first
+  and picks the one for the address you type. The API address must be `https://`, except for a Spelunk on
+  this machine.
+- A key kept the older way, as a credential's password, still works and is still offered in the editor;
+  its password goes to whatever address the host names.
 - **The hostname and port still matter**, though nothing dials them: the host key is pinned under them as it
   is for every host, and the port is what the agent connects to on the server.
 - **There is no falling back to a direct dial**, and a refusal is said in Spelunk's terms: a key Spelunk will
@@ -487,14 +493,15 @@ link, or hands the link to the copy already running, and **connects straight awa
 carries a credential. The hosts links make live in your personal vault, tagged `spelunk`:
 
 - If your personal vault has a host tagged `spelunk` for that server on that Spelunk, DodoSSH connects to it.
-- Otherwise, when a saved host already sends an API key to that same Spelunk, DodoSSH saves a new host in
-  your personal vault — named as the link names it, at the link's address (or `spelunk-<server id>`), port
-  22, signing in through Spelunk with that same key credential, tagged `spelunk` (the tag is made if the
-  vault has none) — and connects to it. It syncs like any host you saved yourself.
-- **The first link from a Spelunk** opens the host editor instead, filled in the same way with sign-in
-  ticked and the tag on, and you choose the credential holding that Spelunk's API key once and save. Every
-  later link from that Spelunk connects straight away. A link can be sent by anything on this machine, so
-  an API key is never sent to an address that no saved host already sends it to.
+- Otherwise, when you have saved a Spelunk key for that Spelunk under Settings → Security — or a saved host
+  already sends an API key there — DodoSSH saves a new host in your personal vault — named as the link
+  names it, at the link's address (or `spelunk-<server id>`), port 22, signing in through Spelunk with that
+  key, tagged `spelunk` (the tag is made if the vault has none) — and connects to it. It syncs like any host
+  you saved yourself.
+- **A link from a Spelunk with no key** opens the host editor instead, filled in the same way with sign-in
+  ticked and the tag on, and you choose that Spelunk's API key once and save. Every later link from that
+  Spelunk connects straight away. A link can be sent by anything on this machine, so an API key is never
+  sent to an address you have not sent it to — saving the key under Security is how you say you have.
 
 A host you set up by hand, or one in a team's vault, is left as it is: a link for its server adds a host of
 its own. A link that arrives while the vault is locked waits for the unlock.