feat(workspace): sealed-area names are confidential by default

The switcher listed sealed areas by name ('lbs', 'stromnetz') on
any glance or screenshot — but the names themselves often carry
client/mandate identity (usertest security finding). The sealed
section now renders one aggregated row ('2 sealed areas') with a
deliberate 'Show names' reveal per menu opening; selection still
pops the regular s:<slug> value. Settings -> Security gains 'list
sealed areas with their names right away' (WorkspacePrefs,
SidebarPrefs pattern, default off).

The aggregate row wraps to two lines — popup menus cap their
width and action texts must never be truncated (the first cut
showed '1 abgeschotte…' in the proof shot). Guard: switcher tests
cover aggregated-until-reveal and the Settings toggle; the old
direct-listing test now asserts the reveal contract. DE+EN.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/widgets/chain_settings_dialog.dart

@@ -12,6 +12,7 @@ import '../data/hub.dart';
 import '../data/hub_auth_token.dart';
 import '../data/registry_token.dart';
 import '../data/sidebar_prefs.dart';
+import '../data/workspace_prefs.dart';
 import '../data/system_actions.dart';
 import '../l10n/app_localizations.dart';
 import '../pages/welcome.dart' show showFaiDoc;
@@ -745,6 +746,20 @@ class _FaiSettingsDialogState extends State<ChainSettingsDialog> {
         theme,
         docSlug: 'security',
       ),
+      // Confidentiality: whether the workspace switcher lists
+      // sealed areas by name or aggregated (default). Mirrors the
+      // SidebarPrefs pattern.
+      ValueListenableBuilder<bool>(
+        valueListenable: WorkspacePrefs.sealedNamesVisible,
+        builder: (context, visible, _) => SwitchListTile(
+          contentPadding: EdgeInsets.zero,
+          title: Text(l.settingsSealedNamesTitle),
+          subtitle: Text(l.settingsSealedNamesBody),
+          value: visible,
+          onChanged: (v) => WorkspacePrefs.setSealedNamesVisible(v),
+        ),
+      ),
+      const SizedBox(height: ChainSpace.xl),
       _RegistryCredentialsPanel(
         configuredChars: _registryTokenChars,
         onSave: _saveRegistryToken,