refactor(ui): open the remaining option menus from PickerSurface

[kipavy]

Follow-up to #203. Four more dropdowns positioned themselves: each measured its
anchor with its own getBoundingClientRect block and painted a
surface-float fixed z-9999 div. Each therefore also missed what PickerSurface
already does — re-measuring while the form panel scrolls, flipping above the
trigger when there is no room below, and becoming a bottom sheet on Android.

keychain/IdentityForm's KeySelector was the furthest gone. Its local
DropdownItem was a copy of PickerOption down to the class list and the accent
check, DropdownDivider a copy of PickerDivider, and its trigger a copy of
PickerTrigger including the 150ms chevron rotation. It also carried a
hand-rolled flip that guessed the menu height from a row count. All of that is
deleted in favour of the shared parts.

KeychainToolbar, VaultPicker and PortInput already used the
canonical rows, so they only lose their positioning code.

PickerSurface grows what those callers needed:

• width: "content" — a menu that sizes to its rows rather than to a narrow
  trigger. Pinned by right when right-aligned, since there is no width to
  subtract from the anchor's edge.
• minWidth — the floor for that mode, so VaultPicker keeps its min-w-52 off
  a text-sized trigger.
• maxHeight — PortInput's list keeps its shorter 240px cap.

Left alone deliberately

SyncDropdown and ShareMenu are anchored panels — header row, close button,
fixed w-64/280px, animate-fadeIn with transformOrigin math — not option
lists; routing them through PickerSurface would be a redesign.
SidebarAccountButton compensates for the UI scale with its own
transform: scale(uiScale), which PickerSurface has no handling for.

connections/KeySelector is intentionally still separate from the keychain one:
that one picks between an inline key and the keychain and ends in a "manage in
keychain" action, this one has a third "no key" state and no key-type badges.
Unifying them would take more props than the two compositions cost lines, and
there is now a comment saying so.

Verification

tsc --noEmit clean; 132 tests across shared, connections and keychain
pass (266 including settings).

Driven in the headless build and read back from screenshots:

• KeychainToolbar — right-aligned, content-width, rows unchanged;
• IdentityForm's key selector — sits at the bottom of the form panel and now
  flips above the trigger, with the accent check on "No key";
• VaultPicker — content width at its 208px floor, left-aligned to the small
  text trigger;
• PortInput — against two emulated ptys, the list opens under the input,
  picking one fills /dev/ttyUSB99 and dismisses the surface.