feat: sealed-area connection switch + identity bar (multi-project stage 3)

The workspace switcher now lists the operator's sealed areas (read from
~/.chain/sealed/ manifests, the same source the CLI uses) below the
shared projects, each with a lock icon and a running/stopped status.
Selecting one is a real connection switch: Studio reconnects its hub
client to the area's own port with a full state reload — one window,
one truth. A stopped area is started first (chain project start) with a
visible notice; a failure surfaces as a copyable error and rolls back to
the shared hub.

While in a sealed area an identity bar under the AppBar is painted in
the area's accent colour and names it, with a one-click Leave back to
the shared hub. The area colour is marking, not theming — Studio's blue
stays the app accent. Selecting a shared project from inside an area
switches the connection back first. The sealed connection is never
persisted across restarts.

New: SealedAreaService (manifest + PID discovery), Workspace sealed
switch logic, ChainSealedIdentityBar, SystemActions.chainProjectStart.
l10n DE+EN. flutter analyze clean; 33 tests green (switcher lists sealed
with lock+status, pill shows active area, identity bar renders in the
area colour). Runtime plumbing (discovery, start, endpoint, reach)
verified headlessly against real sealed instances under a redirected
HOME; the identity-bar screenshot is deferred (display click-automation
failed after sleep on the shared desktop — an environment issue, not a
code gap; the visible components are widget-tested).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

test/sealed_identity_bar_test.dart

@@ -0,0 +1,57 @@
+// Sealed identity bar — stage-3 contract: nothing on the shared hub,
+// and while connected to a sealed area a strip in the area colour
+// naming it + a "Leave" affordance back to the shared hub.
+
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+import 'package:chain_studio/data/sealed_areas.dart';
+import 'package:chain_studio/data/workspace.dart';
+import 'package:chain_studio/l10n/app_localizations.dart';
+import 'package:chain_studio/widgets/chain_sealed_identity_bar.dart';
+
+Widget _host() => const MaterialApp(
+  localizationsDelegates: AppLocalizations.localizationsDelegates,
+  supportedLocales: AppLocalizations.supportedLocales,
+  home: Scaffold(body: ChainSealedIdentityBar()),
+);
+
+const _grid = SealedArea(
+  slug: 'grid',
+  name: 'Testbereich Grid',
+  color: '#e0a458',
+  port: 51100,
+  running: true,
+);
+
+void main() {
+  testWidgets('renders nothing on the shared hub', (tester) async {
+    Workspace.instance.debugSeed(projects: const [], active: '');
+    await tester.pumpWidget(_host());
+    expect(find.byIcon(Icons.lock_outline), findsNothing);
+    expect(find.text('Testbereich Grid'), findsNothing);
+  });
+
+  testWidgets('names the active sealed area with a lock + leave action', (
+    tester,
+  ) async {
+    Workspace.instance.debugSeed(
+      projects: const [],
+      active: '',
+      activeSealed: _grid,
+    );
+    await tester.pumpWidget(_host());
+
+    expect(find.text('Testbereich Grid'), findsOneWidget);
+    expect(find.byIcon(Icons.lock_outline), findsOneWidget);
+    // A one-click way back to the shared hub.
+    expect(find.byIcon(Icons.logout), findsOneWidget);
+
+    // The strip is painted in the area's accent colour (#e0a458),
+    // not the app theme — the "which area am I in?" signal.
+    final material = tester.widget<Material>(
+      find.ancestor(of: find.byIcon(Icons.lock_outline), matching: find.byType(Material)).first,
+    );
+    expect(material.color, const Color(0xFFE0A458));
+  });
+}

test/workspace_switcher_test.dart

@@ -7,6 +7,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
 
 import 'package:chain_studio/data/hub.dart';
+import 'package:chain_studio/data/sealed_areas.dart';
 import 'package:chain_studio/data/workspace.dart';
 import 'package:chain_studio/l10n/app_localizations.dart';
 import 'package:chain_studio/widgets/chain_workspace_switcher.dart';
@@ -84,4 +85,63 @@ void main() {
     expect(Workspace.instance.active, isNull);
     expect(Workspace.instance.isAll, isFalse);
   });
+
+  testWidgets('lists sealed areas with lock + running/stopped status', (
+    tester,
+  ) async {
+    Workspace.instance.debugSeed(
+      projects: [_general],
+      active: '',
+      sealed: const [
+        SealedArea(
+          slug: 'grid',
+          name: 'Grid',
+          color: '#e0a458',
+          port: 51100,
+          running: true,
+        ),
+        SealedArea(
+          slug: 'bank',
+          name: 'Bank',
+          color: '#c25e5e',
+          port: 51101,
+          running: false,
+        ),
+      ],
+    );
+    await tester.pumpWidget(_host());
+    await tester.tap(find.byType(ChainWorkspaceSwitcher));
+    await tester.pumpAndSettle();
+
+    // Sealed areas appear under the sealed header with a lock icon
+    // and a running/stopped status word.
+    expect(find.text('SEALED AREAS'), findsOneWidget);
+    expect(find.text('Grid'), findsOneWidget);
+    expect(find.text('Bank'), findsOneWidget);
+    expect(find.byIcon(Icons.lock_outline), findsWidgets);
+    expect(find.text('running'), findsOneWidget);
+    expect(find.text('stopped'), findsOneWidget);
+  });
+
+  testWidgets('the pill shows the active sealed area with a lock', (
+    tester,
+  ) async {
+    Workspace.instance.debugSeed(
+      projects: [_general],
+      active: '',
+      sealed: const [],
+      activeSealed: const SealedArea(
+        slug: 'grid',
+        name: 'Grid',
+        color: '#e0a458',
+        port: 51100,
+        running: true,
+      ),
+    );
+    await tester.pumpWidget(_host());
+    expect(Workspace.instance.inSealedArea, isTrue);
+    // The closed pill names the sealed area and carries a lock.
+    expect(find.text('Grid'), findsOneWidget);
+    expect(find.byIcon(Icons.lock_outline), findsWidgets);
+  });
 }