feat(ui): vault popover + hub-discovery + OAuth vault-hint

[unforced]

Summary

Implements Phase 2 of the merged Notes UI audit — §2 of design/2026-05-12-notes-ui-audit.md, §5 ship-sequence item #1.

Replaces the header <select> switcher with a popover that surfaces the operator's full hub-side vault list alongside the locally-connected ones. The named gap (Aaron runs four vaults — boulder/default/gitcoin/techne — but Notes only shows the ones already connected, so each new vault means another trip to /add) closes here.

What's in this PR

• VaultPopover component (src/components/VaultPopover.tsx) — two sections (Connected / Available from your hub) plus a "Manage vaults →" footer; outside-click + Escape to close; two variants (header floating, inline for the mobile menu).
• buildVaultPopoverRows() pure diffing function (URL match via normalizeVaultUrl) so the Connected-vs-Available split is testable without React.
• fetchHubVaults() + hubOriginForVault() in src/lib/vault/hub-discovery.ts. Returns the parsed WellKnownVaultEntry[] or null on any failure (network, non-2xx, malformed JSON).
• beginOAuth(..., options) — new fourth arg with params: Record<string,string>. Appended last and guarded so caller params can never overwrite standard OAuth/PKCE params.
• Header.tsx desktop + mobile wired to the new component; standalone "Manage" button removed (the popover footer owns it now).

Design calls made

1. Hub-origin discovery (the §2 open question). Derived from VaultRecord.issuer rather than storing a new field. Rationale:
   • issuer is already captured at OAuth time (OAuthCallback.tsx:54) and under hub-as-issuer semantically equals the hub origin (per the comment at probe.ts:10-13).
   • Standalone-vault case: issuer === vault URL → well-known fetch returns null or empty vaults → Available section omitted. Graceful degradation, no caller code to special-case.
   • No VaultRecord schema change, no migration, no field that could drift out of sync with issuer.
2. OAuth vault=<name> hint plumbing. Last-step URL decoration on authorizeUrl.searchParams via a new options.params bag, exactly as suggested in the design doc. Guarded against standard-param collisions for defense-in-depth.
3. Path A on hub coordination. Notes sends vault=<name> blind. Pre-#240 hubs ignore it; the consent screen renders the picker as today. Future hubs can adopt the hint to pre-select on consent — no Notes change required when they do. Hub steward coordination tracked as a follow-up, not a blocker here.

What's out of scope (per design doc §5)

• Vault-in-URL (/vault/<name>/...) deep-link routing — later PR.
• Unified create flow (item Probe same-origin for a vault and prefill connect flow #12) — Phase 3.
• View-level text-size control (item PR #8.5: attachment remove button #11) — Phase 3 polish.
• Per-tab vault state (item Note view with rendered markdown, wikilinks, and attachments #4), surface-aware theming (item Hotfix: header label fallback + VITE_EXPOSE gate #10), empty-state / network-error UX (items Add /notes/:id/edit with CodeMirror, live preview, and 409 conflict handling #6, Add /new create flow and two-intent delete #7) — later.

Version + changelog

• package.json 0.3.14 → 0.3.15-rc.1 (rc.N convention per parachute-patterns/patterns/governance.md rule 2).
• CHANGELOG entry under ## Unreleased.

Test plan

• Type-check clean (bun run typecheck)
• Lint clean (bun run lint)
• All tests pass (bun run test → 667/667, 24 new)
• Manual smoke: open popover on a multi-vault hub, verify Connected list, Available list (other hub-known vaults), click switch, click Connect → OAuth flow with vault=<name> in the URL
• Mobile: hamburger menu → inline variant of the popover
• Standalone-vault deploy (Available section should be hidden)

🤖 Generated with Claude Code