Make a host take what its group lends it, everywhere it is read

Step 4 of docs/adding-hosts-on-the-phone.md. The domain could resolve a host
against its groups; nothing asked it to. This is the wiring, and it is mostly
one change repeated: read the resolved host, not the stored one.

TryBuildAuthentication and TryBuildConnectionRequest now take the resolved
value beside the stored one, which is where group context was being lost. It
is the only authentication resolution in the product — both heads and both
transports come through it — so a host inheriting its binding would otherwise
have been offered a password prompt on every screen at once. The
credential-username fallback becomes three levels, and Complete still refuses
an empty username, but now only after the chain has been walked; refusing
before it would refuse exactly the hosts inheritance exists to serve.

HostRowViewModel carries its ResolvedHost, resolved once when the list is
built. Address, Authentication and Dialled read it, so a row cannot disagree
with itself about what it dials — and MainWindowViewModel.Rank searches
Address, so a host inheriting 2222 that displayed 22 would have been
unfindable by the port it actually answers on.

HostsBoundTo counts over the resolved binding, which is the difference between
a warning and a silence: a key bound once on a group and inherited by twenty
hosts named nobody, would have been deleted, and would then have refused all
twenty at connect time.

HostFields.From is answered by a refusal rather than by threading a group list
through the sync engine. A relay host may not inherit its port. The reason is
stronger than the convenience: a plaintext column is a derived duplicate the
client supplies when it pushes *this* host, so an inherited port would make it
depend on another item — editing a group would change what the relay dials for
every host beneath it, except that nothing re-pushes those hosts, so the server
would keep dialling the old port until each was next touched for some unrelated
reason. A stale wire on the relay path connects the user to the wrong service.

The editor distinguishes unset from explicit in both directions. An empty port
box means "take the group's" and shows what that will be as a placeholder,
following the group picker as it moves — a pre-filled 2222 would have been
indistinguishable from one the user typed, and saving would have pinned it. The
authentication picker gains a fourth entry, offered only to a host in a group,
because for an ungrouped host it would behave exactly like the first.

Which found a real defect while the tests were being written. Filing an
ungrouped host into a group silently pinned it to a typed password: the picker
had no "Inherit" entry when it opened, so it sat on "Password (ask each time)",
and saving wrote that as a decision — the host would have been pinned to a
prompt nobody asked for and the group's key would never have reached it. Two
guards now: the picker is rebuilt when the group changes, and BuildHost writes
AsksForPassword only for a host that had the alternative on offer.

The group editor is here too, and the plan never assigned it a step. Without it
no group can carry a default, so every line above would have been unreachable.
It grows a parent picker that leaves out the group itself and everything
beneath it — a courtesy rather than the guarantee, since a cycle assembled from
two offline re-parents was never offered that list — and three defaults beside
the name, each of which may be left empty because "lend nothing" is an answer.

Tags are stored and not editable. TagIds merges, encodes and resolves; no
screen can set one yet, and the editor carries the set through a save untouched
so a client that can set them does not lose them to somebody editing a port.

Eight new tests, and they dial. That is the point of them: a resolved value
that never reaches SshConnectionRequest is a label, and every one of these
failures would be silent — a host connecting to the wrong port, or being asked
for a password it does not need, with nothing on screen admitting it.

Verified by the whole suite: 1390 tests over nineteen projects, none failing.
Both heads build. Nothing on the phone has changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/adding-hosts-on-the-phone.md

@@ -4,17 +4,27 @@ The phone can read a keychain and connect through it. It cannot put anything in
 plan for the change that fixes that, and it is written to be picked up cold — the decisions, the reasons, the
 ordered work, and the traps that are already known.
 
-> **Status: steps 1–3 built, 4–6 not started.** The domain is done and the phone has not been touched. Each
-> built step compiles with the whole suite green, which is the rule the ordering below sets.
+> **Status: steps 1–4 built, 5–6 not started.** The domain and the desktop are done and the phone has not
+> been touched. Each built step compiles with the whole suite green, which is the rule the ordering below
+> sets.
 >
 > | Step | State | Notes |
 > | --- | --- | --- |
 > | 1. `HostGroupSecret` grows | **Done** | Five fields, a version rule the codec did not have, a byte pin, and the "groups are flat" prose rewritten in all four places it appeared. |
 > | 2. The `Tag` item kind | **Done** | Secret, codec, merge, cipher, repository, both registries, EF entity and the generated `AddTagItem` migration. |
 > | 3. `HostSecret` grows, `Port` goes nullable | **Done** | `TagSet`, `TagIds`, `Port` as `int?`, `AsksForPassword`, both schema versions, and `HostInheritance` — the resolver. |
-> | 4. The shared view model | Not started | The five port call sites already route through the resolver; the rest of the list below does not. |
-> | 5. The phone | Not started | |
-> | 6. Tests and false prose | Partly done as it went | The guards steps 1–3 tripped are fixed. `docs/design-import-gaps.md` and the three phone files are untouched. |
+> | 4. The shared view model | **Done** | Every choke point below, plus the group editor the plan never assigned a step to and without which nothing could set a default at all. |
+> | 5. The phone | Not started | Nothing in `Views/HostsScreen.axaml`, `Theme/Phone.axaml` or `PhoneShell` has changed. |
+> | 6. Tests and false prose | Partly done as it went | The guards each step tripped are fixed and the connect path is covered. `docs/design-import-gaps.md` and the three phone files still say the `+` is deliberately absent. |
+>
+> **Tags are stored but not editable.** `TagIds` merges, encodes and resolves, and no screen can put one on a
+> host yet — the desktop editor carries the set through a save untouched so that a client which can set them
+> does not lose them. The chips belong with the phone's editors in step 5.
+>
+> **`HostFields.From` was answered by a refusal rather than by threading the resolver into the sync engine.**
+> A relay host may not inherit its port; `HostSecret.TryValidate` refuses one that tries. A plaintext column
+> derived from a *different* item goes stale when that item is edited and nothing re-pushes the hosts beneath
+> it, so the relay would keep dialling the old port — which is worse than the restriction.
 >
 > **One decision was taken that this plan did not specify.** "Three states where there were two" is four, not
 > three: a host can bind a key, bind a credential, be pinned to a typed password, or take its group's answer,