feat(flutter): server settings in the shared views

The Flutter SDK's server was set once, at login, as raw text, and never
shown again: no way to see which server you were on, let alone change it.
The data-browser grew all of that on its Sync page; `lib/atomic/` is meant
to be the reusable Dart SDK, so the same settings belong there.

Adds a Server section to the shared settings dialog: the servers this device
knows (stable order, the active one marked rather than moved), switch, add,
remove, and what the active node says about itself — version, node id, and
what this drive costs there.

Pure Dart, no bridge work. `/server` is a plain JSON-AD endpoint, and the
agent secret is already in the session, so `/drive-usage` can be signed here
— the same code on mobile and on web.

Signing is the risk in reimplementing a scheme in a third language, so Dart
now asserts the same cross-language golden vectors Rust and TS do
(`lib/src/genesis_test_vectors.json`). That caught this: `encode_base64` is
URL-safe and unpadded, and Dart was writing standard base64 with padding.
The server's decoder is tolerant enough that it would have worked by luck.

URL normalization is shared with login, so `localhost:9883` is accepted
wherever a server is typed.

Claude-Session: https://claude.ai/code/session_01VddwtxveM8Zqsf765aQSHY

flutter/lib/atomic/atomic_auth.dart

@@ -0,0 +1,91 @@
+/// Request signing, for the endpoints that check who is asking.
+///
+/// Pure Dart on purpose: the same code signs on mobile and on web, and needs
+/// nothing from the Rust bridge. The agent secret already lives in
+/// [AtomicSession], so Dart can sign without asking Rust for the key.
+///
+/// The scheme is the one `atomic_lib`'s `get_authentication_headers` and
+/// @tomic/lib's `signRequest` implement: sign `"<url> <timestamp>"` and send
+/// the signature, public key, timestamp and agent alongside it. The server
+/// rebuilds the message from the request it received — query string included —
+/// so the URL signed must be the exact URL fetched.
+library;
+
+import 'dart:convert';
+import 'dart:typed_data';
+
+import 'package:ed25519_edwards/ed25519_edwards.dart' as ed;
+
+/// Base64 as Atomic writes it: URL-safe, unpadded — matching `encode_base64`
+/// in `atomic_lib`. Keys and signatures travel in URLs and DIDs, so the
+/// standard alphabet's `+/=` would need escaping.
+String encodeAtomicBase64(List<int> bytes) =>
+    base64Url.encode(bytes).replaceAll('=', '');
+
+/// Base64 as Atomic reads it: either alphabet, padded or not.
+///
+/// Deliberately more tolerant than [encodeAtomicBase64] writes, mirroring
+/// `decode_base64` — secrets and keys minted by older clients (or pasted by
+/// hand) come in both alphabets, and a decoder is the wrong place to be strict.
+Uint8List decodeAtomicBase64(String input) {
+  final standard = input.replaceAll('-', '+').replaceAll('_', '/');
+  final remainder = standard.length % 4;
+  final padded =
+      remainder == 0 ? standard : standard + '=' * (4 - remainder);
+
+  return base64Decode(padded);
+}
+
+/// An agent's keys, as carried in the one-string secret.
+class AtomicAgent {
+  const AtomicAgent({
+    required this.subject,
+    required this.privateKeyB64,
+    required this.publicKeyB64,
+  });
+
+  final String subject;
+  final String privateKeyB64;
+  final String publicKeyB64;
+
+  /// Reads the base64-encoded JSON secret that `setup()` hands out.
+  factory AtomicAgent.fromSecret(String secret) {
+    final decoded = jsonDecode(utf8.decode(decodeAtomicBase64(secret)))
+        as Map<String, dynamic>;
+    final privateKeyB64 = decoded['privateKey'] as String;
+    final privateKey = ed.newKeyFromSeed(decodeAtomicBase64(privateKeyB64));
+
+    return AtomicAgent(
+      subject: decoded['subject'] as String,
+      privateKeyB64: privateKeyB64,
+      publicKeyB64: encodeAtomicBase64(ed.public(privateKey).bytes),
+    );
+  }
+}
+
+/// Signs `message` with the agent's private key.
+String signMessage(String message, String privateKeyB64) =>
+    signBytes(Uint8List.fromList(utf8.encode(message)), privateKeyB64);
+
+/// Signs raw bytes with the agent's private key.
+String signBytes(Uint8List message, String privateKeyB64) {
+  final privateKey = ed.newKeyFromSeed(decodeAtomicBase64(privateKeyB64));
+  final signature = ed.sign(privateKey, message);
+
+  // ed.sign returns the 64-byte signature followed by the message itself.
+  return encodeAtomicBase64(signature.sublist(0, 64));
+}
+
+/// Headers proving to `url`'s server that this agent is asking.
+///
+/// `url` must be the whole URL being fetched, query string and all.
+Map<String, String> signedHeaders(String url, AtomicAgent agent) {
+  final timestamp = DateTime.now().millisecondsSinceEpoch;
+
+  return {
+    'x-atomic-public-key': agent.publicKeyB64,
+    'x-atomic-signature': signMessage('$url $timestamp', agent.privateKeyB64),
+    'x-atomic-timestamp': '$timestamp',
+    'x-atomic-agent': agent.subject,
+  };
+}

flutter/lib/atomic/server_info.dart

@@ -0,0 +1,176 @@
+/// What a server says about itself, and what a drive costs on it.
+///
+/// Plain HTTP against two endpoints every atomic-server has, so this works
+/// against any node — self-hosted included — with no bridge call:
+///
+///   GET /server       → a `Server` resource (JSON-AD). Public.
+///   GET /drive-usage  → a drive's resource count + bytes. Signed; the server
+///                       checks read access to the drive.
+library;
+
+import 'dart:convert';
+
+import 'package:http/http.dart' as http;
+
+import 'atomic_auth.dart';
+
+/// Property URLs of the `Server` class. Handwritten rather than generated —
+/// this describes the node, not anything in a drive. Keep in step with
+/// `lib/src/urls.rs` and the data-browser's `serverOntology.ts`.
+class ServerProps {
+  static const nodeId = 'https://atomicdata.dev/properties/server/nodeId';
+  static const version = 'https://atomicdata.dev/properties/server/version';
+  static const managed = 'https://atomicdata.dev/properties/server/managed';
+  static const portalUrl = 'https://atomicdata.dev/properties/server/portalUrl';
+}
+
+/// A node's own description. Fields are null when the node does not report
+/// them: an older server, or one with no peer-to-peer transport running.
+class ServerInfo {
+  const ServerInfo({
+    this.nodeId,
+    this.version,
+    this.managed = false,
+    this.portalUrl,
+  });
+
+  /// This node's `did:ad:node:...` identity, if its p2p transport is running.
+  final String? nodeId;
+  final String? version;
+
+  /// Whether the node reports to a control plane, rather than being self-hosted.
+  final bool managed;
+
+  /// Where a managed node is administered.
+  final String? portalUrl;
+
+  static const unknown = ServerInfo();
+
+  factory ServerInfo.fromJsonAd(Map<String, dynamic> json) {
+    String? read(String prop) {
+      final value = json[prop];
+
+      return value is String && value.isNotEmpty ? value : null;
+    }
+
+    return ServerInfo(
+      nodeId: read(ServerProps.nodeId),
+      version: read(ServerProps.version),
+      managed: json[ServerProps.managed] == true,
+      portalUrl: read(ServerProps.portalUrl),
+    );
+  }
+}
+
+/// What a drive stores on a node.
+class DriveUsage {
+  const DriveUsage({
+    this.driveName,
+    required this.resourceCount,
+    required this.blobBytes,
+    required this.loroBytes,
+  });
+
+  final String? driveName;
+  final int resourceCount;
+
+  /// Bytes held by file contents.
+  final int blobBytes;
+
+  /// Bytes held by the CRDT documents behind the resources.
+  final int loroBytes;
+
+  int get totalBytes => blobBytes + loroBytes;
+}
+
+/// Asks `serverUrl` what it is. Returns [ServerInfo.unknown] when the node is
+/// unreachable, or too old to describe itself.
+Future<ServerInfo> fetchServerInfo(String serverUrl, {http.Client? client}) async {
+  if (serverUrl.isEmpty) {
+    return ServerInfo.unknown;
+  }
+
+  final http.Client httpClient = client ?? http.Client();
+
+  try {
+    final response = await httpClient.get(
+      Uri.parse('$serverUrl/server'),
+      headers: const {'Accept': 'application/ad+json'},
+    );
+
+    if (response.statusCode != 200) {
+      return ServerInfo.unknown;
+    }
+
+    return ServerInfo.fromJsonAd(
+      jsonDecode(response.body) as Map<String, dynamic>,
+    );
+  } catch (_) {
+    return ServerInfo.unknown;
+  } finally {
+    if (client == null) httpClient.close();
+  }
+}
+
+/// What `driveSubject` stores on `serverUrl`. Null when the node is
+/// unreachable, the agent may not read the drive, or the drive is not there.
+Future<DriveUsage?> fetchDriveUsage(
+  String serverUrl,
+  String driveSubject,
+  AtomicAgent agent, {
+  http.Client? client,
+}) async {
+  if (serverUrl.isEmpty || driveSubject.isEmpty) {
+    return null;
+  }
+
+  final url = Uri.parse('$serverUrl/drive-usage')
+      .replace(queryParameters: {'subject': driveSubject});
+  final http.Client httpClient = client ?? http.Client();
+
+  try {
+    // Sign the URL being fetched, query string and all — the server rebuilds
+    // the signed message from the request it received.
+    final response = await httpClient.get(
+      url,
+      headers: {
+        ...signedHeaders(url.toString(), agent),
+        'Accept': 'application/json',
+      },
+    );
+
+    if (response.statusCode != 200) {
+      return null;
+    }
+
+    final json = jsonDecode(response.body) as Map<String, dynamic>;
+    final name = json['name'];
+
+    return DriveUsage(
+      driveName: name is String && name.isNotEmpty ? name : null,
+      resourceCount: (json['resourceCount'] as num?)?.toInt() ?? 0,
+      blobBytes: (json['blobBytes'] as num?)?.toInt() ?? 0,
+      loroBytes: (json['loroBytes'] as num?)?.toInt() ?? 0,
+    );
+  } catch (_) {
+    return null;
+  } finally {
+    if (client == null) httpClient.close();
+  }
+}
+
+/// Bytes as a person reads them.
+String formatBytes(int bytes) {
+  if (bytes < 1024) return '$bytes B';
+
+  const units = ['KB', 'MB', 'GB', 'TB'];
+  var value = bytes / 1024;
+  var unit = 0;
+
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+
+  return '${value.toStringAsFixed(value < 10 ? 1 : 0)} ${units[unit]}';
+}

flutter/lib/atomic/server_url.dart

@@ -0,0 +1,60 @@
+/// Server URL handling, shared by every screen that takes one from a user.
+///
+/// Kept in step with `normalizeServerUrl` / `sameOrigin` in the data-browser's
+/// SyncRoute: the same URL typed into either client should mean the same thing.
+library;
+
+/// A server URL as typed by a person, made into one that can be fetched.
+///
+/// Requiring a scheme is a papercut — people type `localhost:9883`. Local
+/// addresses get `http` (there is no certificate on a dev box), everything
+/// else `https`. An explicit scheme is always kept.
+String normalizeServerUrl(String input) {
+  final trimmed = input.trim().replaceAll(RegExp(r'/+$'), '');
+
+  if (RegExp(r'^https?://', caseSensitive: false).hasMatch(trimmed)) {
+    return trimmed;
+  }
+
+  if (trimmed.isEmpty) {
+    return '';
+  }
+
+  final isLocal = RegExp(r'^(localhost|127\.0\.0\.1)(:\d+)?$', caseSensitive: false)
+      .hasMatch(trimmed);
+
+  return '${isLocal ? 'http' : 'https'}://$trimmed';
+}
+
+/// Whether two server URLs point at the same server — how "is this the one in
+/// use?" is decided, tolerant of trailing slashes and paths.
+bool sameOrigin(String a, String? b) {
+  if (b == null || b.isEmpty) {
+    return false;
+  }
+
+  try {
+    final ua = Uri.parse(a);
+    final ub = Uri.parse(b);
+
+    return ua.scheme == ub.scheme && ua.host == ub.host && ua.port == ub.port;
+  } catch (_) {
+    return false;
+  }
+}
+
+/// A server URL as shown to a person: the bare authority, keeping the port
+/// (which distinguishes two dev servers) and dropping only the scheme.
+String serverLabel(String url) {
+  try {
+    final parsed = Uri.parse(url);
+
+    if (parsed.host.isEmpty) {
+      return url;
+    }
+
+    return parsed.hasPort ? '${parsed.host}:${parsed.port}' : parsed.host;
+  } catch (_) {
+    return url;
+  }
+}