feat(vault): collapse multi-protocol column to "primary (+N more)"

[damonleelcx]

What

The Vault page's 协议 / PROTOCOLS column rendered every protocol a key speaks, comma-joined. A multi-protocol team key renders one row per protocol group, so that list was repeated into each of those rows — overflowing the 22% column and re-stating the group header.

The column now shows the protocol of the group the row is under, plus a (+N more) hint:

openai, anthropic   →   openai (+1)

The full list is still reachable via the cell's title and the detail drawer.

Why it leads with the row's group

Not the key's first protocol. Otherwise the openai row of an anthropic+openai key labels itself anthropic — the same class of bug 20260713-multiprotocol-vk-web-display fixed for the row provider chip. There's a regression test for exactly this.

No behaviour change for single-protocol keys

extraCount is 0 and no hint renders, so single-protocol and legacy (no-bindings) rows are byte-identical to before.

Notes

• Rule extracted to a pure protocolColumn() helper so it's testable without mounting the 7k-line vault page.
• New i18n key vault.protocolMore (en + zh).

Test

• 7 new unit tests, incl. the reported ['anthropic','openai'] → openai (+1) case, the group-ordering regression, and the empty/legacy fallbacks.
• Full suite: 273 passed; tsc --noEmit clean.
• Verified live in Chrome against a local stack (/user/vault), on a team key bound to two protocols across two providers (anthropic/zhipu + openai_compatible/deepseek). The key renders once per group:
  • group openai (codex) → openai (+1)
  • group anthropic (claude) → anthropic (+1)
  • single-protocol keys in the same list show a bare openai with no hint.

Unrelated deployment bug found while verifying

/user/vault is dead on any server installed by workflow/CD/installer/server-install.sh: its generated nginx config proxies /auth, /team, /system, /local-api but has no location /api, so /api/user/{vault,import}/* falls through try_files to the SPA — GET returns index.html with a 200 (looks fine, parses as empty), POST returns nginx 405. Backend implements the routes (router.go:737). Tracked separately; not part of this PR.

🤖 Generated with Claude Code