[valicm]

Teams: say when a team waits for two-step verification
A team that requires two-step verification hides its vaults from a
member without it, and the app said nothing: the vault just never
came. The sync round now notes it (Hold::Totp): from 403
totp_setup_required, or, for a member who never had the vaults, from
the team's policy and the account when none of its vaults is listed.
The sidebar, the phone's hosts screen and the team's page say so and
open the authenticator setup; turning it on or off starts a round.

First screen: new account, invites, suggested passwords; Hosts as home
The first screen offers New vault, New account and Sign in. New
account makes the vault and its sync account in one go. An invite
opened before there's a vault (or pasted under "Joining a team?") shows
there, fills in the server and address, and once there's an account
Teams opens with it looked up; one that came while sync was off opens
once sync is on. "Suggest a strong password" picks five words from
EFF's long wordlist. On desktop, a vault with hosts opens on the Hosts
page, which gets a Quick connect button.

Lists and team pages redesigned
Hosts, groups, a group's page, keys, snippets, tunnels and VPNs are
tables (ListParts.tsx): the name is the row's main action, then the
columns people scan, then the row's actions on hover or focus; greenbar
bands, one primary button per page, a quiet × to close. Hosts gets a
quick connect bar, Add from… for importing and clouds, tag filters, and
a connected host's name goes to its session. Keys has tabs for keys,
identities and host CAs, kept when an editor closes. The sidebar shows
status squares and lists open sessions first.

Teams says per team what waits for you. A team's page puts what needs
you first (a member to confirm, a device to approve, a key to rotate,
two-step verification, SSH keys to publish), then tabs: Members (with
invites not accepted yet), Vaults, Your SSH keys, Settings (grouped,
saved together, ownership apart) and Activity. Invite people takes
several addresses at once.

Quick connect button, grouped hosts indented, session log filters, team actions
A page opened from another page (Import, Clouds, a group, Session logs)
closes back to it. Quick connect is a Hosts page button instead of a
bar. A group's hosts sit indented under it. Session logs is a table
with a search and Vault, Group and Host menus. A team's page has New
vault (a bar, like New team) and the owner's plan button beside Invite
people. The role menu fits its column.