Share the shelf as well as what is on it, and ask a group which vault

A group is where hosts are filed and what lends them a port, a username and a key,
and until now it could only ever be made in the vault this machine files new items
into. So sharing a vault shared the machines and not the arrangement: a colleague
opened four hosts filed under a group they could read the name of and nothing else,
and the group a teammate made had no card, no heading and no way to be corrected
from the screen looking straight at the hosts inside it. Recorded as half shipped in
docs/design-import-gaps.md, and this is the other half.

The list stopped being the active vault's. It was narrow for two stated reasons —
a row shown across vaults has to carry which vault it lives in, because rename and
delete both need it, and two vaults may hold a "production" each, which a layout
with one heading per group cannot tell apart — and both are now paid for rather than
avoided. Every row carries its vault, the badge beside the name says which, and the
two cards sit side by side saying what they are.

The three shapes of the group read are now deliberately different sizes. The list is
what a person looks at, so a hidden vault's groups leave it: a card that cannot be
opened onto anything is worse than no card. The per-vault lists are what a picker
offers, because a picker is always asking about one vault. The map is what a host's
GroupId resolves through, and it stays widest of all — including over hidden vaults,
since a group lends a port and hiding a vault must never change what one of its
hosts dials. RebuildGroups is the one place hiding is applied, which is what keeps
those answers apart.

The editor asks which vault on the terms the host editor's picker set: while adding
only, hidden where there is one writable vault, and never offered afterwards, because
the two are encrypted under different keys and moving an item is a delete and a
retype. Its parent picker is that vault's alone, for the reason the host editor's
group picker is one level down — a parent in another vault is a level half the key
holders cannot resolve, and their hosts would inherit from nothing. + NEW GROUP
inside an open group departs from NewHost and takes that group's vault rather than
the standing preference: a group made inside another is in its parent's vault by
construction, and answering "inside PLATFORM" with a group elsewhere and no parent
would drop the one thing the button said.

Two smaller things follow from the cards spanning vaults. Dragging a host onto a
group card in another vault is refused with both names, because the write it would
make is exactly the id-nobody-can-resolve the host editor's picker was fixed to
prevent, and treating it as "no group" would unfile a host somebody was plainly
filing. And a group being renamed says its vault in the drawer's header, since the
picker is not drawn for an existing one and renaming a colleague's shelf without
being told whose it is is the edit most worth naming.

The save target is a nullable field behind a property that falls back to the standing
preference. The group name box is bound whether or not anything raised an editor over
it — that is what the desktop's group bar was, and typing a name into it and pressing
ADD is still a way to make a group, which would otherwise have written to no vault
at all.

1575 tests pass, five more than before: a group filed into a shared vault is listed
and renamed there, the editor's picker does not move the keychain screen's, the
parent picker offers only its own vault, a cross-vault drop is refused, and hiding a
vault takes the cards without changing what its hosts dial.

tests/DodoSSH.Client.App.Tests/VaultVisibilityTests.cs

@@ -451,8 +451,10 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
     /// <remarks>
     /// It is drawn in the menu and ticked, because a vault missing from a list of vaults reads as something
     /// having gone wrong — and it cannot be switched off, because snippets, logs, buckets and the editable
-    /// group and tag lists are all read from it alone. Switching it off would empty half the application
-    /// rather than filter it, so the refusal says why instead of doing nothing.
+    /// tag list are all read from it alone. Switching it off would empty half the application rather than
+    /// filter it, so the refusal says why instead of doing nothing. The group list is no longer among them:
+    /// it spans every readable vault, and hiding one drops that vault's cards and headings the way it drops
+    /// its hosts.
     /// </remarks>
     [Fact]
     public async Task ThePersonalVaultIsListedAndCannotBeHidden()
@@ -471,6 +473,67 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
         shell.StatusMessage.ShouldContain("always shown");
     }
 
+    /// <remarks>
+    /// <para>
+    /// The two halves of a group, and hiding a vault has to move exactly one of them. The cards and
+    /// headings are a list a person reads, so a hidden vault's group leaves it — a folder that cannot be
+    /// opened onto anything is worse than no folder. What a group also is is a port, a username and a
+    /// binding lent to the hosts beneath it, and that must not move: those hosts are still in
+    /// <c>Hosts</c>, which is what the connect path and the transfers screen read.
+    /// </para>
+    /// <para>
+    /// Asserted through the resolved port rather than through the map directly, because the resolved port
+    /// is what a connection actually dials. A hidden vault whose hosts silently fell back to 22 would be
+    /// this split having collapsed, and nothing on screen would say so.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task HidingAVault_TakesItsGroupCardsButNotWhatItsHostsDial()
+    {
+        await UnlockedAsync();
+
+        await shell.Vaults.LoadAsync(Token);
+
+        var teamVaultId = await CreateVaultAsync("Platform secrets");
+        var vault = shell.Vault!;
+
+        await vault.LoadAsync(Token);
+
+        vault.NewGroupCommand.Execute(null);
+
+        vault.GroupEditorSelectedVault =
+            vault.GroupEditorVaultChoices.Single(choice => choice.VaultId == teamVaultId);
+
+        vault.GroupEditorLabel = "production";
+        vault.GroupEditorDefaultPort = 2222;
+
+        await vault.SaveGroupCommand.ExecuteAsync(null);
+
+        await AddHostAsync(vault, teamVaultId, "prod-db", "db.internal");
+
+        vault.SelectedHost = vault.Hosts.Single(
+            row => string.Equals(row.Label, "prod-db", StringComparison.Ordinal));
+
+        vault.EditSelectedHostCommand.Execute(null);
+
+        vault.EditorSelectedGroup = vault.EditorGroupChoices.Single(
+            choice => string.Equals(choice.Label, "production", StringComparison.Ordinal));
+
+        await vault.SaveHostCommand.ExecuteAsync(null);
+
+        vault.Groups.ShouldHaveSingleItem().VaultId.ShouldBe(teamVaultId, vault.Status);
+
+        await HideAsync(teamVaultId);
+        await vault.LoadAsync(Token);
+
+        vault.Groups.ShouldBeEmpty("a hidden vault's groups are cards onto hosts that are not drawn");
+
+        vault.Hosts
+            .Single(row => string.Equals(row.Label, "prod-db", StringComparison.Ordinal))
+            .Resolved.Port.Value
+            .ShouldBe(2222, "hiding a vault must never change what one of its hosts dials");
+    }
+
     /// <remarks>
     /// The switches are the readable vaults, personal first. A vault whose grant awaits re-wrap has nothing
     /// that would decrypt, so a switch for it would do nothing at all.