sync: what the on-device round found

Everything here came from running the account flow against a real
Nextcloud rather than from reading the code.

Discovery
- A typed bare origin now gets the RFC 6764 well-known probe. It was
  returned as the only candidate, so `https://cloud.example.com` — what
  people actually type — was PROPFIND'd against the web UI, answered 405,
  and a working Nextcloud reported as "not a CalDAV server".
- A same-host HTTPS→HTTP redirect is put back on TLS instead of refused
  (`dav` change 7). A Nextcloud behind a TLS-terminating proxy without
  `overwriteprotocol` builds every redirect with http://, including the
  /.well-known/caldav hop discovery depends on. Cross-host still throws.
- Outcomes carry a `Cause` the UI translates, not the server's own words.
  "HTTP 405 Method Not Allowed" told someone entering an address nothing,
  in a language they may not read, from outside strings.xml.
- An IPv6 origin keeps its brackets: `HttpUrl.host` returns "fd00::1", so
  the rebuilt origin did not parse and a homelab address came back as
  "not an address".

Login Flow v2
- The poll response's scheme is coerced, never refused. Nextcloud returns
  the app password exactly once, so throwing there burned a live
  credential and left it dangling in the user's device list. The host
  mismatch already worked this way; the scheme now matches it.

Accounts
- The accounts screen observes Room and the sign-in state instead of
  taking a snapshot, so a sync landing — or a 401 stopping an account —
  reaches a screen that is already open.
- A per-account detail screen, and provider identity (`CalDavProvider`)
  shared with the quirk table so one list drives both the icon and the
  warning.
- The password field masks: floret-kit's `InlineTextField` gained a
  visual transformation, since `KeyboardType.Password` only tells the IME
  to drop suggestions.

docs/SYNC-PLAN.md

@@ -854,6 +854,28 @@ would have quarantined every Lightning-authored task permanently.
 was re-requested for ever with nothing counting it, and account removal blocked
 on a 30-second connect timeout before anything visible happened.
 
+## Noted for later, not built
+
+**Sign in via the installed Nextcloud app.** If the user already has Nextcloud
+Files on the device, they should be able to pick the account they are *already
+signed into* rather than typing a server address and minting a password by hand
+— which is the longest and most failure-prone part of the flow, and the one that
+produces the 405s and "wrong password" dead ends this branch keeps working
+around.
+
+Nextcloud's Android app exposes its accounts through the **Single Sign-On**
+library (`nextcloud/Android-SingleSignOn`): an AIDL binding to the Files app,
+which returns a per-app token after the user picks an account and approves. It
+would slot in beside Login Flow v2 as a third path on the address step —
+offered only when the Files app is actually installed, with the typed-address
+flow unchanged as the fallback for everyone else.
+
+Deliberately not in this branch. It adds a GPL-licensed dependency and a second
+credential *shape* (an SSO token that the Files app can revoke independently of
+anything we store), and both deserve their own decision rather than being
+absorbed into a chunk. Worth doing: it is the difference between "type your
+server address" and "tap your account".
+
 ## What moves to floret-kit
 
 Recorded here so the follow-up branch is a file move rather than a rediscovery.