Spelunk: sign each device in through the browser instead of keeping Spelunk API keys in the vault

A Spelunk API key reaches one organisation, so a server elsewhere - oc-linux in Orange Climate - was
refused before it reached the agent. Each device now signs in to a Spelunk once, under Settings ->
Security -> Spelunk or from a Spelunk host's editor: the OAuth authorization code flow with PKCE for a
native app (RFC 8252), with Spelunk as the authorization server. The browser opens Spelunk's
/api/app-sign-in/authorize with a loopback redirect (the app's own scheme on Android), the person signs
in there however they normally do and allows "DodoSSH on <device>", and the code is redeemed at
/api/app-sign-in/token for an app session token. That token opens terminals in every organisation its
person is in, with the role they have on each server at the time; tunnel tickets send no organisation.

The sign-in stays on the device: sealed in the local cache under the LocalCacheKey (AAD resource type
18, bound to its row), never synced, wiped with the cache, and only ever sent to the Spelunk it came
from. A 401 from Spelunk forgets it; SIGN OUT ends it there and here, and so does signing out of
DodoSSH. Before every Spelunk connection DodoSSH asks its own identity provider whether its sign-in
still stands (a forced refresh, at most once a minute), and an account it refuses is signed out of
DodoSSH and of every Spelunk on the device.

A route names no key any more: Spelunk hosts are written at host schema 11, which an older build shows
read-only and asks to be updated for, and a payload that still names a key credential decodes with the
id skipped. The SpelunkKey item type is gone: SyncEntityType 14, ChangeEntityType 14 and AAD type 17
are retired, the server drops spelunk_key and its change-log rows, and the client cache drops its
cached items, outbox entries and conflicts of that type. A link still never starts a sign-in: from a
Spelunk this device is not signed in to it opens the editor, which offers to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/DodoSSH.Client.Android/App.axaml.cs

@@ -271,7 +271,15 @@ public sealed partial class DodoSshApp : Avalonia.Application
             copyToClipboard: copyToClipboard,
             readClipboard: readClipboard,
 
-            updates: updates);
+            updates: updates,
+
+            // Signing in to Spelunk comes back the way signing in to DodoSSH does — by intent, to the same
+            // registered redirect — and names this phone by its model, for difference 5's reason.
+            spelunkAccounts: new SpelunkAccounts(
+                browser,
+                path => new AndroidRedirectCallback(path),
+                TimeProvider.System,
+                PhoneEnvironment.DeviceName));
 
         // Started rather than awaited: framework initialisation must not block on a schema migration. The
         // view model shows its own progress and handles its own failures.

src/DodoSSH.Client.Android/Views/HostsScreen.axaml

@@ -1290,8 +1290,8 @@
 
           <!--
             The relay's alternative, and the desktop drawer's Spelunk card in this head's controls: ticking
-            one unticks the other. The key is a keychain credential chosen here, never typed here. See
-            VaultViewModel.Spelunk.cs.
+            one unticks the other. No credential is chosen here: the host is reached as whoever this phone signed
+            in to that Spelunk as, and a button signs in when it has not. See VaultViewModel.Spelunk.cs.
           -->
           <CheckBox IsChecked="{Binding EditorThroughSpelunk}" MinHeight="44">
             <TextBlock Classes="mono" FontSize="11.5"
@@ -1303,16 +1303,13 @@
                      PlaceholderText="Spelunk API address (https://api.…)" />
             <TextBox Classes="field" Text="{Binding EditorSpelunkServerId}"
                      PlaceholderText="Spelunk server id" />
-            <TextBlock Classes="detail" Text="Spelunk API key" />
-            <ComboBox ItemsSource="{Binding EditorSpelunkKeyChoices}"
-                      SelectedItem="{Binding EditorSelectedSpelunkKey}"
-                      HorizontalAlignment="Stretch" MinHeight="44">
-              <ComboBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:AuthenticationChoice">
-                  <TextBlock Classes="mono" FontSize="12" Text="{Binding Label}" />
-                </DataTemplate>
-              </ComboBox.ItemTemplate>
-            </ComboBox>
+            <TextBlock Classes="detail" TextWrapping="Wrap"
+                       Text="{Binding EditorSpelunkSignInNote}"
+                       IsVisible="{Binding EditorSpelunkSignInNote, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+            <Button Classes="secondary" MinHeight="44" HorizontalAlignment="Stretch"
+                    Content="SIGN IN TO SPELUNK"
+                    Command="{Binding SignInToEditorSpelunkCommand}"
+                    IsVisible="{Binding EditorSpelunkNeedsSignIn}" />
             <!-- The desktop card's sign-in box. See SpelunkRoute.SignInThroughSpelunk. -->
             <CheckBox IsChecked="{Binding EditorSpelunkSignIn}" MinHeight="44">
               <TextBlock Classes="mono" FontSize="11.5"
@@ -1321,7 +1318,7 @@
             </CheckBox>
           </StackPanel>
           <TextBlock Classes="body"
-                     Text="Spelunk's agent on the server connects to its SSH server for you, so the server needs no open SSH port. Choose a Spelunk API key (Admin role) saved from the desktop's Settings → Security, or a credential whose password is the key; it is sent only to the address above. Signing in through Spelunk logs you in as the account Spelunk names, with a key made for each connection and never kept. Connects only while Spelunk and its agent are reachable." />
+                     Text="Spelunk's agent on the server connects to its SSH server for you, so the server needs no open SSH port. You connect as yourself in Spelunk, which takes the Admin role on the server, and DodoSSH has to be online to check your account first. Signing in through Spelunk logs you in as the account Spelunk names, with a key made for each connection and never kept. Connects only while Spelunk and its agent are reachable." />
 
           <!--
             This page covers the whole screen while it is open, which is why it needs a Status line of its