Key fields: keep the browser's password UI away, fix the keyboard layout

"Trying to use a different provider on the web app glitches out completely" -
an iPhone photo of the first-run gate with iOS's saved-password sheet laid
over it ("password for proxmox...") and the provider field stuck under the
keyboard.

- The key fields (gate, Settings, provider rows) were type=password with
  autocomplete=off, which iOS/Safari and 1Password/LastPass read as a login.
  They now carry autoComplete="new-password", data-form-type="other",
  data-lpignore="true", autoCorrect/autoCapitalize=off and inputMode=text:
  the mask stays, the password overlay goes. The custom base URL gets
  inputMode=url and the same hints.
- The gate's keyboard handling scrolled to the Continue button instead of the
  field being edited, so with the provider rows open the keyboard covered the
  input and the locked wrapper could not be scrolled to it. The wrapper is
  user-scrollable again, alignment anchors on the focused element (Continue
  is the fallback), and the corner controls hide while the keyboard is up
  rather than landing on the card.

providers-test drives a fake visualViewport (340px, installed before mount)
and pins the three layout contracts plus the hardening attributes. All 16
suites green, contrast clean. Version 0.7.2, SW v94.

tests/providers-test.mjs

@@ -245,6 +245,28 @@ try {
         "freezmo.providers.v1": JSON.stringify({ keys: {}, models: {}, customBaseUrl: PROVIDER_BASE, generation: null }),
       },
     });
+    /* A driveable visual viewport, installed before the app mounts, so the
+       on-screen-keyboard layout can be tested without a real keyboard. */
+    await page.addInitScript(() => {
+      window.__vv = { resize: [] };
+      Object.defineProperty(window, "visualViewport", {
+        configurable: true,
+        get: () => ({
+          get height() {
+            return window.__vvHeight ?? window.innerHeight;
+          },
+          get offsetTop() {
+            return window.__vvOffset ?? 0;
+          },
+          addEventListener: (type, handler) => {
+            (window.__vv[type] ??= []).push(handler);
+          },
+          removeEventListener: (type, handler) => {
+            window.__vv[type] = (window.__vv[type] ?? []).filter((entry) => entry !== handler);
+          },
+        }),
+      });
+    });
     await page.goto(`http://127.0.0.1:${GATE_PORT}/`, { waitUntil: "networkidle" });
     await page.waitForTimeout(1400);
 
@@ -257,6 +279,66 @@ try {
 
     const gateKey = page.locator('input[aria-label="Custom (OpenAI-compatible) API key"]');
     await gateKey.scrollIntoViewIfNeeded();
+
+    /* An API key is not a login: the field must keep iOS/Safari's saved
+       password sheet away ("new-password" + the password-manager hints), or
+       the AutoFill overlay lands on top of the gate (as it did on the user's
+       phone). */
+    const hardening = await gateKey.evaluate((element) => ({
+      autocomplete: element.getAttribute("autocomplete"),
+      formType: element.getAttribute("data-form-type"),
+      lpignore: element.getAttribute("data-lpignore"),
+      inputMode: element.getAttribute("inputmode"),
+    }));
+    check(
+      "gate: the key field keeps the password UI away",
+      hardening.autocomplete === "new-password" &&
+        hardening.formType === "other" &&
+        hardening.lpignore === "true" &&
+        hardening.inputMode === "text",
+      JSON.stringify(hardening),
+    );
+
+    /* The on-screen keyboard: fake the visual viewport shrinking the way a
+       phone keyboard does, then check the layout still holds — the focused
+       field stays in view, the wrapper stays scrollable and the corner
+       controls step aside instead of landing on the card. */
+    await gateKey.focus();
+    await page.evaluate(() => {
+      window.__vvHeight = 340;
+      (window.__vv.resize ?? []).forEach((handler) => handler());
+    });
+    await page.waitForTimeout(500);
+    const keyboardLayout = await page.evaluate(() => {
+      const input = document.querySelector('input[aria-label="Custom (OpenAI-compatible) API key"]');
+      const root = document.querySelector("div[style*='height']");
+      const wrap = input?.closest("div[class*='overflow-y-auto']");
+      const corner = document.querySelector("button[aria-label='How do I get a key?']");
+      return {
+        inputBottom: input ? Math.round(input.getBoundingClientRect().bottom) : null,
+        rootHeight: root ? Math.round(root.getBoundingClientRect().height) : null,
+        wrapped: Boolean(wrap),
+        scrollable: wrap ? getComputedStyle(wrap).overflowY : null,
+        cornerVisible: corner ? corner.offsetParent !== null : false,
+      };
+    });
+    check(
+      "gate: with the keyboard up the field stays in view",
+      keyboardLayout.inputBottom !== null && keyboardLayout.rootHeight !== null && keyboardLayout.inputBottom <= keyboardLayout.rootHeight,
+      JSON.stringify(keyboardLayout),
+    );
+    check(
+      "gate: with the keyboard up the card stays scrollable",
+      keyboardLayout.wrapped && keyboardLayout.scrollable === "auto",
+      JSON.stringify(keyboardLayout),
+    );
+    check("gate: the corner controls step aside for the keyboard", keyboardLayout.cornerVisible === false, JSON.stringify(keyboardLayout));
+    await page.evaluate(() => {
+      window.__vvHeight = undefined;
+      (window.__vv.resize ?? []).forEach((handler) => handler());
+    });
+    await page.waitForTimeout(300);
+
     await gateKey.fill(PROVIDER_KEY);
     await gateKey.locator("xpath=..").getByRole("button", { name: "Save key", exact: true }).click();
     await page.waitForTimeout(2200);