dashboard: keys edited, the last removed with a password, failures kept

The credentials dialog listed a user's keys whole, to add one or
remove one but the last, and any failure replaced the dialog with the
error, the form lost.

* A key is shown short: its type, the first and last four characters
  of what tells it apart (an Ed25519 key's base64 after the part all of
  them share), its comment; the whole line in its tooltip.
* A key can be edited, its name and its line: saved under the name, a
  new name written first and the old one removed.
* A user with a password on this node (`--htpasswd`) may remove its
  last key: it logs in by the password. GET /auth/keys says so
  (`password`), and DELETE /auth/keys/{id} takes it then; the rules no
  longer keep the last key on every node (no other node can tell who
  has a password where; under a strict policy the signed entry keeps
  one still).
* What fails says why beside where it was asked (the add form, the
  edited row, the removed one), which stays as it was, to be set right
  and tried again.

3 files changed, 20 insertions, 8 deletions

diff --git a/docs/access.md b/docs/access.md
index 2df7270..4bb5945 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -36,8 +36,10 @@ password hashes: every member reads the document).
   with the line, `DELETE /auth/keys/<name>`; under a strict policy, by signing its
   entry with only its keys changed (`continuum-signed key-add laptop
   ~/.ssh/id_ed25519.pub`, `key-remove laptop`), with a key it holds already. Every
-  node takes that from the user itself, as from one who may manage users, but never
-  its last key removed (`409`): one who may manage users may.
+  node takes that from the user itself, as from one who may manage users. Its last key
+  it removes only on a node where it has a password (`--htpasswd`), which it logs in
+  by then (`409` elsewhere); under a strict policy, never (it signs its entry with
+  one).
 
 ## A new swarm
 
diff --git a/docs/dashboard.md b/docs/dashboard.md
index 2966c79..2bd126a 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -25,9 +25,15 @@ dashboard is open; it ends with the token's lifetime, or with "Log out of this
 browser" on the login page, or "log out" in the user's menu on the dashboard (its
 name, top right), which ends this browser's session only. Where the page got in by
 what it can't end, the browser's password or the proxy's, "log out" is greyed, and
-says how instead. The menu's "credentials…" shows the user's keys, to add one (its
-`.pub` line) or remove one but the last; under a strict policy, how to sign them anew
-(`continuum-signed key-add`); and where its password is: in each node's `--htpasswd`. The page and the login page run their
+says how instead. The menu's "credentials…" shows the user's keys, each by its name
+and as much of the key as fits the dialog, cut in the middle where it doesn't (its end
+and comment always shown, the whole in its tooltip), and `edit` at the right: its name
+and `.pub` line in fields, to save, or to delete with the red `Delete` (on a second
+click from half a second to 3 s after the first, as in the document box; the last key
+only where the user has a password on this node, which it logs in by then); or one
+added below; what fails says why where it was asked, to be set right and tried again. Under a
+strict policy, it says how to sign them anew (`continuum-signed key-add`); and where
+the password is: in each node's `--htpasswd`. The page and the login page run their
 own script only (a content security policy naming it by its hash), and no other page
 may frame them. The API listens on localhost unless `--bind-addr` says otherwise;
 to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000
@@ -241,7 +247,9 @@ measured.
   this node knows of them. The browser must reach that dashboard: not one behind NAT, on
   Tor alone, or plain `http` from an `https` page; the node allows this page's origin
   as a member's dashboard (`--cors-origins` for others). Subscriptions are kept in the
-  browser, and handed over with the rest.
+  browser, and handed over with the rest; going to another node's dashboard, the node
+  left is subscribed to there (this node itself never is: its links and messages are
+  the page's own).
 * **Right-click a node**: its menu: subscribing to its links (or not), and `go to its
   dashboard`, greyed where the node publishes none, and on this node's own.
 * **Go to a node's dashboard** (its menu): in this page, where the node publishes one
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 4a49d2b..efda5e2 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -981,7 +981,7 @@ paths:
     get:
       tags: [Auth]
       summary: Your keys
-      description: Your keys, your registry entry as recorded, and under a strict policy the envelope holding it (`signed`), which signing it anew names (`prev`).
+      description: Your keys, your registry entry as recorded, under a strict policy the envelope holding it (`signed`), which signing it anew names (`prev`), and whether you have a password on this node (`password`), so you may remove your last key here.
       responses:
         '200':
           description: Yours.
@@ -993,6 +993,7 @@ paths:
                   keys: { type: object, additionalProperties: { type: string } }
                   entry: { type: object }
                   signed: { type: string, nullable: true }
+                  password: { type: boolean }
         '404': { description: No entry of yours. }
 
   /auth/keys/{id}:
@@ -1015,10 +1016,11 @@ paths:
     delete:
       tags: [Auth]
       summary: Remove one of your keys
+      description: Your last only with a password on this node (`--htpasswd`).
       responses:
         '204': { description: Done. }
         '404': { description: No entry of yours, or no such key. }
-        '409': { description: Strict policy. }
+        '409': { description: Strict policy, or your last key and no password on this node. }
 
   /auth/whoami:
     get: