Make a host take what its group lends it, everywhere it is read

Step 4 of docs/adding-hosts-on-the-phone.md. The domain could resolve a host
against its groups; nothing asked it to. This is the wiring, and it is mostly
one change repeated: read the resolved host, not the stored one.

TryBuildAuthentication and TryBuildConnectionRequest now take the resolved
value beside the stored one, which is where group context was being lost. It
is the only authentication resolution in the product — both heads and both
transports come through it — so a host inheriting its binding would otherwise
have been offered a password prompt on every screen at once. The
credential-username fallback becomes three levels, and Complete still refuses
an empty username, but now only after the chain has been walked; refusing
before it would refuse exactly the hosts inheritance exists to serve.

HostRowViewModel carries its ResolvedHost, resolved once when the list is
built. Address, Authentication and Dialled read it, so a row cannot disagree
with itself about what it dials — and MainWindowViewModel.Rank searches
Address, so a host inheriting 2222 that displayed 22 would have been
unfindable by the port it actually answers on.

HostsBoundTo counts over the resolved binding, which is the difference between
a warning and a silence: a key bound once on a group and inherited by twenty
hosts named nobody, would have been deleted, and would then have refused all
twenty at connect time.

HostFields.From is answered by a refusal rather than by threading a group list
through the sync engine. A relay host may not inherit its port. The reason is
stronger than the convenience: a plaintext column is a derived duplicate the
client supplies when it pushes *this* host, so an inherited port would make it
depend on another item — editing a group would change what the relay dials for
every host beneath it, except that nothing re-pushes those hosts, so the server
would keep dialling the old port until each was next touched for some unrelated
reason. A stale wire on the relay path connects the user to the wrong service.

The editor distinguishes unset from explicit in both directions. An empty port
box means "take the group's" and shows what that will be as a placeholder,
following the group picker as it moves — a pre-filled 2222 would have been
indistinguishable from one the user typed, and saving would have pinned it. The
authentication picker gains a fourth entry, offered only to a host in a group,
because for an ungrouped host it would behave exactly like the first.

Which found a real defect while the tests were being written. Filing an
ungrouped host into a group silently pinned it to a typed password: the picker
had no "Inherit" entry when it opened, so it sat on "Password (ask each time)",
and saving wrote that as a decision — the host would have been pinned to a
prompt nobody asked for and the group's key would never have reached it. Two
guards now: the picker is rebuilt when the group changes, and BuildHost writes
AsksForPassword only for a host that had the alternative on offer.

The group editor is here too, and the plan never assigned it a step. Without it
no group can carry a default, so every line above would have been unreachable.
It grows a parent picker that leaves out the group itself and everything
beneath it — a courtesy rather than the guarantee, since a cycle assembled from
two offline re-parents was never offered that list — and three defaults beside
the name, each of which may be left empty because "lend nothing" is an answer.

Tags are stored and not editable. TagIds merges, encodes and resolves; no
screen can set one yet, and the editor carries the set through a save untouched
so a client that can set them does not lose them to somebody editing a port.

Eight new tests, and they dial. That is the point of them: a resolved value
that never reaches SshConnectionRequest is a label, and every one of these
failures would be silent — a host connecting to the wrong port, or being asked
for a password it does not need, with nothing on screen admitting it.

Verified by the whole suite: 1390 tests over nineteen projects, none failing.
Both heads build. Nothing on the phone has changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/DodoSSH.Client.Domain/HostSecret.cs

@@ -229,6 +229,20 @@ public sealed record HostSecret : IVaultSecret
     /// The plaintext copy is derived from this, in one place, so the address can only ever leave the
     /// payload as a consequence of the user turning this on. See ADR 0004.
     /// </para>
+    /// <para>
+    /// <b>A relay host may not inherit its port</b>, and <see cref="TryValidate"/> refuses one that tries.
+    /// The reason is what a plaintext column is: a derived duplicate the client supplies when it pushes
+    /// <em>this</em> host. An inherited port would make that duplicate depend on a different item, so
+    /// editing a group would silently change what the relay dials for every host beneath it — except that
+    /// nothing re-pushes those hosts, so the server would keep dialling the old port until each was next
+    /// touched for some unrelated reason. Copying a value that can change elsewhere into a column nothing
+    /// refreshes is a stale wire, and a stale wire on the relay path connects the user to the wrong service.
+    /// </para>
+    /// <para>
+    /// The cost is one field on the hosts that opt into the relay, which is the same set of hosts already
+    /// opting to publish their address. It is what lets the plaintext columns be derived from a
+    /// <see cref="HostSecret"/> alone, in one place, with no group in reach — see <c>HostFields</c>.
+    /// </para>
     /// </remarks>
     public bool RelayEnabled { get; init; }
 
@@ -322,6 +336,12 @@ public sealed record HostSecret : IVaultSecret
             return false;
         }
 
+        if (RelayEnabled && Port is null)
+        {
+            reason = "A host dialled through the relay needs a port of its own, not its group's.";
+            return false;
+        }
+
         reason = null;
         return true;
     }