Fill in the Spelunk API key on the Security page, as a synced Spelunk key that goes only to its own address

Settings → Security gains a SPELUNK section: an API address and a key, saved as a new keychain item, a Spelunk key (SyncEntityType 14, AadResourceType 17, server table spelunk_key via the AddSpelunkKeyItem migration). It is ciphertext only on the server, lives in the personal vault, syncs like every secret, and holds the key together with the one address it may be sent to. The key box empties once saved; the list shows name, address and how many hosts use each key, never the key. Saving a key for an address that already has one replaces it, and deleting goes through the shared confirmation card with the hosts that would stop connecting.

A host's route names a saved key where it named a credential, in the same apiKeyCredentialId field, so no host schema changes and an older build reads such a host as one whose key credential has gone. At connect a saved key is sent only to its own address; a host naming it with another Spelunk address is refused in words. Keys kept as a credential's password still work. The editor offers saved keys first and picks the one saved for an address as it is typed.

A link from a Spelunk with a saved key now connects straight away, including the first one: saving the key is the user's say-so that the first-link editor used to ask for.

The address and key merge as one pair, so two concurrent edits can never pair one device's key with another's address, and the key never reaches the conflict log.

src/DodoSSH.Client.Domain/SpelunkRoute.cs

@@ -19,11 +19,11 @@ namespace DodoSSH.Client.Domain;
 /// the vault holds. So the concession ADR 0004 argues for the relay's address is not made for this.
 /// </para>
 /// <para>
-/// <b>The API key is referenced, not embedded.</b> <see cref="ApiKeyCredentialId"/> names an ordinary
-/// keychain credential whose password is the key, for the reason <see cref="HostSecret.CredentialId"/>
-/// gives: one Spelunk key is the key for every server in its organisation, and a copy per host is twenty
-/// places to rotate it and one to forget. It also means the key is encrypted, synced, merged and shown in
-/// the keychain exactly as a password is, with no item type of its own to build and keep in step.
+/// <b>The API key is referenced, not embedded.</b> <see cref="ApiKeyCredentialId"/> names the keychain item
+/// holding it, for the reason <see cref="HostSecret.CredentialId"/> gives: one Spelunk key is the key for
+/// every server in its organisation, and a copy per host is twenty places to rotate it and one to forget.
+/// That item is a <see cref="SpelunkKeySecret"/>, which also says the one address the key may go to, or —
+/// for a host set up before those existed — an ordinary credential whose password is the key.
 /// </para>
 /// </remarks>
 public sealed record SpelunkRoute
@@ -50,12 +50,22 @@ public sealed record SpelunkRoute
     /// <summary>The server's id in Spelunk.</summary>
     public required Guid ServerId { get; init; }
 
-    /// <summary>The keychain credential whose password is the Spelunk API key.</summary>
+    /// <summary>
+    /// The keychain item holding the Spelunk API key: a <see cref="SpelunkKeySecret"/>, or a credential whose
+    /// password is the key.
+    /// </summary>
     /// <remarks>
+    /// <para>
+    /// Named for the credential it always was, and kept so on the wire: item ids are unique across kinds, so
+    /// the one id says which, and a build that predates Spelunk keys reads a host naming one as a host whose
+    /// key credential has gone — refused at connect, and kept as it is by an edit — rather than as damage.
+    /// </para>
+    /// <para>
     /// Required rather than nullable. A route with no key can never be opened, and a host saved that way
     /// would refuse every connection with a sentence about something the editor let through. The reference
     /// can still dangle — the credential may be deleted on another machine — and that is refused where it
     /// is noticed, at connect, exactly as a missing SSH credential is.
+    /// </para>
     /// </remarks>
     public required Guid ApiKeyCredentialId { get; init; }
 
@@ -113,7 +123,7 @@ public sealed record SpelunkRoute
 
         if (ApiKeyCredentialId == Guid.Empty)
         {
-            reason = "A host reached through Spelunk needs a credential holding its Spelunk API key.";
+            reason = "A host reached through Spelunk needs its Spelunk API key chosen.";
             return false;
         }