Land Drops (#279) beside the settings pages (#278) d366306dae7d resolution

- **Drops: snippets of files, each its own small repository (#279):** a drop is one or more files, as a gist is, kept as an Oxygen repository of its own at `/{owner}/drops/{id}` (a 24-hex-digit id), so every edit is a signed change with history and diffs, and `oxy clone` and `oxy push` take its address. Make one at `/drops/new` (title, description, files, public or secret), with `POST /api/v1/drops`, or with `oh drop create FILE… [--secret] [-d TEXT] [-t TITLE]`; the hub commits it as your delegate, as web edits are, so you delegate to the hub's key first. Your Drops page (`/drops`, under your profile and in the site band) lists and manages them; someone else's shows their public drops only. A secret drop is listed nowhere but readable by anyone with its address. Drops never appear among repositories (profiles, the dashboard, Explore, search, `GET /api/v1/repos`); Admin › Storage labels them. Only the owner edits a drop; the owner or a site administrator deletes it. Push protection covers drop pushes and what the web and the API commit. API: `GET`/`POST /drops`, `GET /users/{name}/drops`, `GET`/`PATCH`/`DELETE /drops/{id}`; `oh drop list|view|delete`. `drops` is now a reserved name, for owners and for repositories. Not yet: forks, stars, comments, embedding, and drops in backups.

- **Repository settings are one page per setting (#278):** a repository's Settings was one long page; it is now a sidebar of grouped pages (General, Code, Flow, Integrations, Data, Danger zone) with the page shown beside it, the current one marked, each at its own address (`/{owner}/{name}/settings/push-protection`, `/settings/runs`, …; `/settings` is General). Pages a role cannot use are not listed and are not found. Every form keeps its address and now returns to its own page with what happened, so reloading does not send it again. Links elsewhere point at the new pages (the push protection refusal names `/settings/push-protection`), and a kept `/settings#section` link opens the page that has it. On a narrow screen the sidebar becomes a compact list above the page. An archived repository's settings open for its admins again, so they can bring it back.

  /* Drops (oxygenhub#279): add and remove file rows on the drop form.

     Without this file the form has its rows and one empty one; more come

     by saving and editing again. */

  (function () {

    var list = document.querySelector("[data-drop-files]");

    var add = document.querySelector("[data-drop-add]");

    if (!list || !add) return;

    function wire(row) {

      var rm = row.querySelector("[data-drop-remove]");

      if (!rm) return;

      rm.hidden = false;

      rm.addEventListener("click", function () {

        if (list.querySelectorAll("[data-drop-file]").length > 1) row.remove();

        else row.querySelectorAll("input, textarea").forEach(function (f) { f.value = ""; });

      });

    }

    list.querySelectorAll("[data-drop-file]").forEach(wire);

    add.hidden = false;

    add.addEventListener("click", function () {

      var rows = list.querySelectorAll("[data-drop-file]");

      var row = rows[rows.length - 1].cloneNode(true);

      row.querySelectorAll("input, textarea").forEach(function (f) { f.value = ""; f.textContent = ""; });

      list.appendChild(row);

      wire(row);

      row.querySelector("input").focus();

    });

  })();

  /* A repository's settings were one page with a section per #anchor;

     each is a page of its own now (oxygenhub#278). A kept link such as

     /settings#flow-priority opens the page that holds that section, when

     the viewer has it (its link is in the sidebar). */

  (function () {

    var nav = document.querySelector("[data-settings-anchors]");

    var hash = location.hash.slice(1);

    if (!nav || !/^[a-z-]+$/.test(hash)) return;

    var moved = { "history-scan": "push-protection", "flow-priority": "runs", "flow-supersede": "runs", "agent-gates": "gates" };

    var link = nav.querySelector('a[data-slug="' + (moved[hash] || hash) + '"]');

    if (link && link.getAttribute("aria-current") !== "page") location.replace(link.getAttribute("href") + "#" + hash);

  })();

            "  - If {is} not a secret (an example, a test value), a maintainer can allow its fingerprint, with a reason, at {settings}/push-protection; then push again."