fix(team-vault): never show a secret the server refused as saved (#608)

[kipavy]

Closes #608. Server side: VoltiusApp/server#103.

Problem

On a self-hosted server older than its port-knock support (VoltiusApp/server#100), editing a team-vault host:

• Adding a knock port failed with team secret upload failed for knock_sequence:<id>: 400.
• The port still showed when the editor was reopened. writeSecretAt cached the value before the upload and never took it back, so it lasted until the next vault load.
• The Port Knocking switch is stored on the host itself and saved fine. The host could end up with knocking on and no ports, and then every teammate's connect failed with "The knock sequence for this host isn't available on this device."

The client had no way to know what the server supports.

Fix

• Capability check (services/serverCapabilities.ts): reads team_secret_types from /v1/meta (added in feat(meta): advertise the team secret types the server accepts server#103), refreshed at most every 5 minutes and reset on logout. A type the server does not list is never uploaded.
• Servers that advertise nothing: the upload is tried. A 400 on connection_knock_sequence is read as "server too old" and remembered until the server advertises a list. Servers that already store knock sequences but predate the list keep working.
• Cache: a refused value is rolled back to what the server holds, so nothing looks saved.
• Message and log: the toast reads "This Voltius server is too old to store this in a team vault. Ask its administrator to update the server, then save again." The app log gets a warning with the secret type and client version.
• Knock panel: for a team-vault host on such a server it shows a warning instead of the port list, and the switch can only be turned off.
• Stranded switch: if the sequence edited in this form was refused, the form turns knocking back off and saves that.
• fetchServerMeta is now shared by identity picks and the capability check.

Personal-vault hosts are unaffected whatever the server supports.

Cons

• A server that advertises nothing still gets one failed save before the panel locks, because only the refusal reveals it.
• Hosts already left with knocking on and no ports are not repaired. Their owner turns the switch off, or re-enters the ports once the server is updated.
• One extra unauthenticated GET /v1/meta at most every 5 minutes while team secrets are written or a host editor is open.
• A secret queued for retry after a personal-to-team move still stays readable on the mover's device, as before. It uploads once the server is updated.

Deploy order

Server first (VoltiusApp/server#103), as usual. The client also works against the current server, which advertises nothing.

Tests

• New serverCapabilities.test.ts (8 tests): advertised list, unknown server, refusal memory, refresh interval, failed fetch, reset.
• secretRouting.test.ts: unlisted type never uploaded and cache restored; 400 from an old server drops the value and is remembered; 400 on a type every server stores stays an ordinary failure; queued key keeps its local copy; unreachable meta never blocks an upload.
• PortKnockPanel.test.tsx and connectionForms.characterisation.test.tsx: warning shown, port list hidden, switch off-only, sequence withheld and knocking switched back off, personal host untouched.
• tsc --noEmit: clean. vitest: all 807 test files pass.
• Not run in the live app, and not run against a real pre-chore(deps): bump the actions group with 8 updates #100 server. I confirmed in the server source that a build before feat(team-vault): accept connection knock sequences as a team secret server#100 answers 400 to this type.