Sync credentials as a vault item type, and bind one to a host

Closes the largest remaining M1 gap in the data layer: a username and password
can live in the vault, sync between machines, and be named by a host as how it
authenticates. What is not here is the interface for creating one — see the end
of this message.

The third item type, and the first one that cost almost nothing to add. Server:
a VaultCredential row, an EF configuration, a migration, and a CredentialKind.
Client: a secret, a codec, a merge, a cipher, a kind, a repository facade and a
session property. No new reconciliation logic, no change to the sync engine, no
client cache migration. That was the whole point of the item-kind seam, and this
is the evidence it holds.

The narrowest type of the three on plaintext, and not for symmetry. A host has a
deliberate concession — the relay needs an address it can resolve. A key has a
fingerprint, public by nature, which this client still declines to send. A
password has no part that is safe to expose: not its length, not a hash, not a
hint. So CredentialKind refuses every plaintext field there is, hydrates none,
and the table has no column to put one in.

HostSecret.CredentialId is the password counterpart of SshKeyId, and the two are
mutually exclusive. SSH itself would happily try a key and fall back to a
password, but a host naming both leaves "how does this authenticate?" without a
single answer — the interface, the connect path and the user would each be free
to guess differently. TryValidate refuses it. One consequence was not
anticipated: "a full host" stops being a coherent idea, which is what broke
AFullHost_RoundTrips and is now written into that test.

The schema version became a ladder rather than a maximum: credential-bound is 3,
key-bound is 2, neither is still 1. Adding credentials therefore does not drag
every key-bound host in every vault onto a version that clients understanding
keys perfectly well would refuse to edit. A test pins exactly that, because it is
the property the whole content-dependent-version rule exists to provide, and the
obvious implementation would quietly lose it.

Two tests had become false and said so:

- Push_AnUnsupportedEntityType_IsInvalidNotAFailedBatch used Credential as its
  example of a type this server does not implement. It now asks the server's own
  registry what is still missing, so it cannot go stale again, and skips with a
  reason if that set ever empties.
- ThePullFilterNamesEveryTypeThisBuildSynchronises pinned the exact list, which
  is what it is for.

Also fixes ten nullable warnings — eight in SyncEndpointTests, two in a test file
added earlier today. Neither set was introduced here; both were invisible until
an unrelated change forced their project to recompile, which means the
zero-warning claims made earlier in this work only ever covered what happened to
be rebuilt.

777 tests green. Zero warnings, dotnet format clean.

Not done, and deliberately: the credential interface. The vault column is 340
pixels wide and already holds two lists and two editors, kept from clipping its
own buttons at the window's minimum height only by the one-editor-at-a-time rule
added earlier today. A third list and a third editor would recreate that defect
rather than avoid it, so the column needs a shape decision first. Credentials
sync; they cannot yet be created in the interface.

src/DodoSSH.Client.Domain/CredentialSecret.cs

@@ -0,0 +1,76 @@
+using System.Diagnostics.CodeAnalysis;
+
+namespace DodoSSH.Client.Domain;
+
+/// <summary>
+/// A username and password as the user sees it, decrypted.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The same bargain <see cref="SshKeySecret"/> documents applies here and is worth not repeating in full:
+/// the password is an ordinary managed string, it cannot be wiped, and a process dump taken while the vault
+/// is unlocked contains it. What that buys is that it never reaches the disk or the server in a form either
+/// can read.
+/// </para>
+/// <para>
+/// <see cref="Username"/> is optional and overrides the host's when set, which is the reason this is a
+/// separate item rather than two more fields on a host: one credential is very often the same account on
+/// twenty machines, and duplicating it per host means rotating it in twenty places and missing one.
+/// </para>
+/// </remarks>
+public sealed record CredentialSecret : IVaultSecret
+{
+    private readonly string? username;
+
+    /// <summary>What the user calls this credential.</summary>
+    public required string Label { get; init; }
+
+    /// <summary>
+    /// The password.
+    /// </summary>
+    /// <remarks>
+    /// Required, and an empty one is not valid — see <see cref="TryValidate"/>. A credential with no password
+    /// is not a credential, and storing one would produce an item that looks usable and fails at the
+    /// handshake with an error about authentication rather than about the vault.
+    /// </remarks>
+    public required string Password { get; init; }
+
+    /// <summary>
+    /// The account this credential is for, when it is not the host's own username.
+    /// </summary>
+    /// <remarks>
+    /// Empty is normalised to null, as <see cref="SshKeySecret.Passphrase"/> is and for the same kind of
+    /// reason: blank and absent mean one thing here — "use the host's username" — and two spellings of one
+    /// state would give two clients different payload bytes for an identical credential, and make
+    /// <c>Username is not null</c> an unreliable answer to "does this override the host?".
+    /// </remarks>
+    public string? Username
+    {
+        get => username;
+        init => username = string.IsNullOrEmpty(value) ? null : value;
+    }
+
+    /// <summary>Free text.</summary>
+    public string? Notes { get; init; }
+
+    /// <summary>Whether this is storable, and why not if it is not.</summary>
+    public bool TryValidate([NotNullWhen(false)] out string? reason)
+    {
+        if (string.IsNullOrWhiteSpace(Label))
+        {
+            reason = "A credential needs a name.";
+            return false;
+        }
+
+        if (Password.Length == 0)
+        {
+            // Length rather than IsNullOrWhiteSpace: a password of spaces is a password, and refusing it
+            // would lock someone out of a host over a validation opinion.
+            reason = "A credential needs a password.";
+            return false;
+        }
+
+        reason = null;
+        return true;
+    }
+}

src/DodoSSH.Client.Domain/CredentialSecretCodec.cs

@@ -0,0 +1,116 @@
+using System.Diagnostics.CodeAnalysis;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace DodoSSH.Client.Domain;
+
+/// <summary>A decoded credential payload, together with the schema version it was written at.</summary>
+/// <param name="Credential">The credential.</param>
+/// <param name="SchemaVersion">The version the writing client used.</param>
+public sealed record CredentialSecretDocument(CredentialSecret Credential, int SchemaVersion)
+{
+    /// <inheritdoc cref="HostSecretDocument.IsReadOnly" />
+    public bool IsReadOnly => SchemaVersion > CredentialSecretCodec.CurrentSchemaVersion;
+}
+
+/// <summary>
+/// Encodes and decodes the plaintext inside a credential item's encrypted payload.
+/// </summary>
+/// <remarks>
+/// Mirrors <see cref="SshKeySecretCodec"/>, for the same reasons and with the same guarantees: JSON so a
+/// field can be added without a migration, deterministic property order so an unchanged credential does not
+/// look like a change to the sync engine, and a separate mutable document type so a decode failure cannot
+/// produce a half-built credential that looks valid downstream.
+/// </remarks>
+public static class CredentialSecretCodec
+{
+    /// <summary>The schema version this build writes.</summary>
+    public const int CurrentSchemaVersion = 1;
+
+    /// <summary>Serialises a credential to the bytes that get sealed.</summary>
+    /// <exception cref="ArgumentException">The credential is not valid for storage.</exception>
+    public static byte[] Encode(CredentialSecret credential)
+    {
+        ArgumentNullException.ThrowIfNull(credential);
+
+        if (!credential.TryValidate(out var reason))
+        {
+            throw new ArgumentException(reason, nameof(credential));
+        }
+
+        var document = new CredentialPayloadDocument
+        {
+            SchemaVersion = CurrentSchemaVersion,
+            Label = credential.Label,
+            Password = credential.Password,
+            Username = credential.Username,
+            Notes = credential.Notes,
+        };
+
+        return JsonSerializer.SerializeToUtf8Bytes(
+            document, CredentialPayloadJsonContext.Default.CredentialPayloadDocument);
+    }
+
+    /// <summary>Parses a decrypted payload.</summary>
+    /// <inheritdoc cref="HostSecretCodec.TryDecode" path="/remarks" />
+    public static bool TryDecode(
+        ReadOnlySpan<byte> payload,
+        [NotNullWhen(true)] out CredentialSecretDocument? document)
+    {
+        document = null;
+
+        CredentialPayloadDocument? parsed;
+        try
+        {
+            parsed = JsonSerializer.Deserialize(
+                payload, CredentialPayloadJsonContext.Default.CredentialPayloadDocument);
+        }
+        catch (JsonException)
+        {
+            return false;
+        }
+
+        if (parsed is null || parsed.SchemaVersion < 1)
+        {
+            return false;
+        }
+
+        var candidate = new CredentialSecret
+        {
+            Label = parsed.Label ?? string.Empty,
+            Password = parsed.Password ?? string.Empty,
+            Username = parsed.Username,
+            Notes = parsed.Notes,
+        };
+
+        if (!candidate.TryValidate(out _))
+        {
+            return false;
+        }
+
+        document = new CredentialSecretDocument(candidate, parsed.SchemaVersion);
+        return true;
+    }
+}
+
+/// <summary>The serialised shape. Mutable and nullable because it models untrusted input.</summary>
+/// <inheritdoc cref="HostPayloadDocument" path="/remarks" />
+internal sealed class CredentialPayloadDocument
+{
+    public int SchemaVersion { get; set; }
+
+    public string? Label { get; set; }
+
+    public string? Password { get; set; }
+
+    public string? Username { get; set; }
+
+    public string? Notes { get; set; }
+}
+
+[JsonSourceGenerationOptions(
+    PropertyNamingPolicy = JsonKnownNamingPolicy.CamelCase,
+    DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+    UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip)]
+[JsonSerializable(typeof(CredentialPayloadDocument))]
+internal sealed partial class CredentialPayloadJsonContext : JsonSerializerContext;

src/DodoSSH.Client.Domain/CredentialSecretMerge.cs

@@ -0,0 +1,111 @@
+namespace DodoSSH.Client.Domain;
+
+/// <summary>The merged credential, and everything that had to be overridden to produce it.</summary>
+/// <param name="Merged">The credential to store and push.</param>
+/// <param name="Conflicts">Empty when the two sides were reconcilable field by field.</param>
+public sealed record CredentialMergeResult(
+    CredentialSecret Merged,
+    IReadOnlyList<HostFieldConflict> Conflicts)
+{
+    /// <summary>Whether anything had to be overridden.</summary>
+    public bool HasConflicts => Conflicts.Count > 0;
+}
+
+/// <summary>
+/// Merges two divergent versions of a credential against the version they both started from.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Every field is a scalar, so this is the same shape as <see cref="SshKeySecretMerge"/> and reuses
+/// <see cref="HostFieldConflict"/> for the same reason: the conflict log, the storage behind it and the
+/// interface that shows it are shared, and a parallel record with identical members would have to be mapped
+/// at every boundary.
+/// </para>
+/// <para>
+/// <b>The password never reaches the conflict log.</b> Reported as having differed and nothing more, exactly
+/// as <c>SshKeySecretMerge</c> does for key material — and here the case for it is if anything plainer, since
+/// a discarded password is very often still the live password on some other system. The user loses nothing
+/// they could act on: nobody reconciles two passwords by reading them side by side.
+/// </para>
+/// <para>
+/// The username is shown, because it is not a secret and knowing which of two accounts the merge dropped is
+/// exactly what makes the notice useful.
+/// </para>
+/// </remarks>
+public static class CredentialSecretMerge
+{
+    /// <summary>Produces the merged credential.</summary>
+    /// <param name="ancestor">The version both sides branched from.</param>
+    /// <param name="local">The pending local version.</param>
+    /// <param name="remote">The server's current version.</param>
+    public static CredentialMergeResult Merge(
+        CredentialSecret ancestor,
+        CredentialSecret local,
+        CredentialSecret remote)
+    {
+        ArgumentNullException.ThrowIfNull(ancestor);
+        ArgumentNullException.ThrowIfNull(local);
+        ArgumentNullException.ThrowIfNull(remote);
+
+        var conflicts = new List<HostFieldConflict>();
+
+        var merged = new CredentialSecret
+        {
+            // Null-forgiving on the two required fields, as the host and key merges do for the same reason:
+            // the merge returns one of its three inputs, and all three are non-null by construction.
+            Label = Resolve(
+                nameof(CredentialSecret.Label),
+                ancestor.Label,
+                local.Label,
+                remote.Label,
+                conflicts,
+                redact: false)!,
+            Password = Resolve(
+                nameof(CredentialSecret.Password),
+                ancestor.Password,
+                local.Password,
+                remote.Password,
+                conflicts,
+                redact: true)!,
+            Username = Resolve(
+                nameof(CredentialSecret.Username),
+                ancestor.Username,
+                local.Username,
+                remote.Username,
+                conflicts,
+                redact: false),
+            Notes = Resolve(
+                nameof(CredentialSecret.Notes),
+                ancestor.Notes,
+                local.Notes,
+                remote.Notes,
+                conflicts,
+                redact: false),
+        };
+
+        return new CredentialMergeResult(merged, conflicts);
+    }
+
+    private static string? Resolve(
+        string name,
+        string? ancestor,
+        string? local,
+        string? remote,
+        List<HostFieldConflict> conflicts,
+        bool redact)
+    {
+        var merge = ThreeWayMerge.Scalar(ancestor, local, remote, StringComparer.Ordinal);
+
+        if (merge.IsConflicted)
+        {
+            conflicts.Add(new HostFieldConflict(
+                name,
+                MergeSide.Local,
+                redact ? "(kept the server's value)" : merge.Value ?? "(none)",
+                redact ? "(a different value was discarded)" : merge.Discarded ?? "(none)",
+                DiscardedWasRemoval: false));
+        }
+
+        return merge.Value;
+    }
+}

src/DodoSSH.Client.Domain/HostSecret.cs

@@ -82,6 +82,25 @@ public sealed record HostSecret : IVaultSecret
     /// </remarks>
     public Guid? SshKeyId { get; init; }
 
+    /// <summary>
+    /// The vault credential to authenticate with, or null to be asked for a password.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The password counterpart of <see cref="SshKeyId"/>, with the same reasoning about ids rather than
+    /// copies, the same dangling-reference handling, and the same refusal to fall back when the reference
+    /// cannot be resolved. One credential is very often the same account on twenty hosts, which is exactly
+    /// why it is referenced and not embedded — a copy per host is twenty places to rotate and one to forget.
+    /// </para>
+    /// <para>
+    /// <b>Mutually exclusive with <see cref="SshKeyId"/>.</b> SSH itself would happily try a key and fall
+    /// back to a password, but a host that names both leaves "how does this authenticate?" without a single
+    /// answer — and the interface, the connect path and the user would each be free to guess differently.
+    /// One host, one method; <see cref="TryValidate"/> enforces it.
+    /// </para>
+    /// </remarks>
+    public Guid? CredentialId { get; init; }
+
     /// <summary>
     /// Whether this host may be dialled through the server relay.
     /// </summary>
@@ -143,6 +162,18 @@ public sealed record HostSecret : IVaultSecret
             return false;
         }
 
+        if (CredentialId == Guid.Empty)
+        {
+            reason = "A credential reference cannot be an empty id; use no credential instead.";
+            return false;
+        }
+
+        if (SshKeyId is not null && CredentialId is not null)
+        {
+            reason = "A host authenticates with a key or with a credential, not both.";
+            return false;
+        }
+
         reason = null;
         return true;
     }

src/DodoSSH.Client.Domain/HostSecretCodec.cs

@@ -59,8 +59,11 @@ public static class HostSecretCodec
     /// <summary>The version that introduced <see cref="HostSecret.SshKeyId"/>.</summary>
     public const int SshKeyIdSchemaVersion = 2;
 
+    /// <summary>The version that introduced <see cref="HostSecret.CredentialId"/>.</summary>
+    public const int CredentialIdSchemaVersion = 3;
+
     /// <summary>The highest schema version this build can write.</summary>
-    public const int CurrentSchemaVersion = SshKeyIdSchemaVersion;
+    public const int CurrentSchemaVersion = CredentialIdSchemaVersion;
 
     /// <summary>Serialises a host to the bytes that get sealed.</summary>
     /// <exception cref="ArgumentException">The host is not valid for storage.</exception>
@@ -91,6 +94,7 @@ public static class HostSecretCodec
             Options = options,
             RelayEnabled = host.RelayEnabled,
             SshKeyId = host.SshKeyId,
+            CredentialId = host.CredentialId,
         };
 
         return JsonSerializer.SerializeToUtf8Bytes(
@@ -110,14 +114,24 @@ public static class HostSecretCodec
     /// use the newer field.
     /// </para>
     /// <para>
-    /// The rule generalises, and the next field added should follow it: a host is written at the version
-    /// that introduced the newest field it actually carries. It also means the bytes for a host with no key
-    /// are identical to what this codec produced before <see cref="HostSecret.SshKeyId"/> existed, so
-    /// adding the field did not make every host in every vault look like a change to the sync engine.
+    /// The rule generalises, and every field added since has followed it: a host is written at the version
+    /// that introduced the newest field it actually carries. It also means the bytes for a host that binds
+    /// nothing are identical to what this codec produced before either binding existed, so adding the fields
+    /// did not make every host in every vault look like a change to the sync engine.
+    /// </para>
+    /// <para>
+    /// The two bindings are mutually exclusive — see <see cref="HostSecret.CredentialId"/> — so this reads as
+    /// a ladder rather than a maximum. If a future field is <em>not</em> exclusive with an older one, this
+    /// becomes the maximum over the versions of the fields present, which is the same rule stated more
+    /// generally.
     /// </para>
     /// </remarks>
-    private static int SchemaVersionFor(HostSecret host) =>
-        host.SshKeyId is null ? BaseSchemaVersion : SshKeyIdSchemaVersion;
+    private static int SchemaVersionFor(HostSecret host) => host switch
+    {
+        { CredentialId: not null } => CredentialIdSchemaVersion,
+        { SshKeyId: not null } => SshKeyIdSchemaVersion,
+        _ => BaseSchemaVersion,
+    };
 
     /// <summary>
     /// Parses a decrypted payload.
@@ -184,6 +198,7 @@ public static class HostSecretCodec
             Options = options,
             RelayEnabled = parsed.RelayEnabled,
             SshKeyId = parsed.SshKeyId,
+            CredentialId = parsed.CredentialId,
         };
 
         if (!candidate.TryValidate(out _))
@@ -236,6 +251,9 @@ internal sealed class HostPayloadDocument
     /// makes a host with no key encode exactly as it did before the field existed.
     /// </remarks>
     public Guid? SshKeyId { get; set; }
+
+    /// <inheritdoc cref="SshKeyId" />
+    public Guid? CredentialId { get; set; }
 }
 
 [JsonSourceGenerationOptions(

src/DodoSSH.Client.Domain/HostSecretMerge.cs

@@ -114,6 +114,14 @@ public static class HostSecretMerge
                 remote.SshKeyId,
                 conflicts,
                 static id => id?.ToString() ?? "no key"),
+
+            CredentialId = Field(
+                nameof(HostSecret.CredentialId),
+                ancestor.CredentialId,
+                local.CredentialId,
+                remote.CredentialId,
+                conflicts,
+                static id => id?.ToString() ?? "no credential"),
         };
 
         return new HostMergeResult(merged, conflicts);