Expand a leading ~, and say what the failing command said

Three things, two of which are the same failure seen from opposite ends.

**A working directory of `~/repos/ai-app` never worked.** Everything
crossing to the remote side is single-quoted, which is right for paths,
model names and prompts alike -- unquoted they would be shell syntax
rather than data. It is wrong for exactly one character: `~` means "expand
me", and quoting is what stops expansion. So the remote shell was handed
the literal four-character directory `~` and correctly said it did not
exist, which reads as the path being wrong rather than the quoting.

Paths now go through `quote_path`, which emits `"$HOME"` for a leading
`~/` and single-quotes the rest. The variable expands, the expansion is
not re-split or globbed because it is double-quoted, and nothing after it
gains a meaning -- there is a test that pushes a quote-and-semicolon
injection through the tilde branch and gets back one absurd path rather
than three commands. `$HOME` is set by every shell this can land in, so
this does not depend on the remote side being POSIX; verified by running
the generated script under both sh and fish, which is what the dev VM
actually uses.

**The phone could not have told you any of that.** The exit report kept
the last line of stderr, and a shell's error message ends with a blank
line -- so the last line was empty, the report was a bare exit status, and
the seven lines of fish complaining sat in the server's log where nobody
holding a phone is looking. It now keeps the last 50 lines in a ring and
reports them with blank lines trimmed from both ends. The tests use the
real fish `cd` failure as their fixture.

**The status bar was unreadable.** `isAppearanceLightStatusBars` was
hardcoded to `true` -- dark icons -- which was right against the default
light surface and wrong the moment the app wore Mocha. It now asks the
scheme's own background for its luminance, so changing the palette cannot
reintroduce it.

**And the address field takes `user@host:port`.** One field rather than
two, because that is how an address is written everywhere else and a port
that is nearly always 22 does not deserve its own box on a phone keyboard.
Absent means absent rather than 22: the backend already decides that
default, and writing it here would be a second answer in a second place.
A colon only means "port" when it can -- brackets for IPv6 as ssh writes
them, otherwise exactly one colon followed by digits.

Looked at on the emulator: the status bar, and the form, whose label I
then shortened because it wrapped onto a second line and made that field
taller than the two beside it.

server/src/ssh.rs

@@ -88,7 +88,7 @@ fn remote_script(program: &str, args: &[String], cwd: Option<&Path>) -> String {
     let mut script = String::new();
     if let Some(cwd) = cwd {
         script.push_str("cd ");
-        script.push_str(&quote(&cwd.to_string_lossy()));
+        script.push_str(&quote_path(&cwd.to_string_lossy()));
         script.push_str(" && ");
     }
     script.push_str("exec ");
@@ -100,6 +100,36 @@ fn remote_script(program: &str, args: &[String], cwd: Option<&Path>) -> String {
     script
 }
 
+/// Quotes a path, expanding a leading `~` and nothing else.
+///
+/// [`quote`] is right for every other word crossing to the remote side and
+/// wrong for exactly one character. `~` means "expand me", and single
+/// quotes are what stop expansion -- so a working directory typed as
+/// `~/repos/ai-app` arrived as the literal four-character directory `~`,
+/// and the remote shell said it did not exist. Which is true, and reads
+/// like the path being wrong rather than the quoting.
+///
+/// `"$HOME"` rather than handing the tilde to the shell unquoted: the
+/// variable is expanded, the expansion is not re-split or globbed because
+/// it is double-quoted, and everything after it stays single-quoted and
+/// literal. So the one character that has to mean something keeps meaning
+/// it, and nothing else gains a meaning. `$HOME` is set by every shell
+/// this can land in, including the fish login shell on the dev VM, which
+/// is why this does not depend on the remote shell being POSIX.
+///
+/// `~user` is deliberately not handled: there is no portable expansion for
+/// it, and inventing one would mean guessing another account's home
+/// directory. It stays literal and fails with the shell's own message.
+fn quote_path(path: &str) -> String {
+    if path == "~" {
+        return "\"$HOME\"".to_string();
+    }
+    match path.strip_prefix("~/") {
+        Some(rest) => format!("\"$HOME\"/{}", quote(rest)),
+        None => quote(path),
+    }
+}
+
 /// Single-quotes one word for a POSIX shell.
 ///
 /// Everything crossing to the remote side goes through here: paths, model
@@ -195,8 +225,39 @@ mod tests {
         assert!(!rendered.contains(&"IdentitiesOnly=yes".to_string()));
     }
 
+    /// The one character quoting must not swallow.
+    ///
+    /// A working directory typed as `~/repos/ai-app` was arriving as the
+    /// literal directory `~`, and the remote shell reported it missing --
+    /// which reads as the path being wrong rather than the quoting being
+    /// wrong, and cost an evening on exactly that misreading.
+    #[test]
+    fn a_leading_tilde_expands_and_nothing_else_does() {
+        assert_eq!(quote_path("~"), "\"$HOME\"");
+        assert_eq!(quote_path("~/repos/ai-app"), "\"$HOME\"/'repos/ai-app'");
+        // Only leading, and only its own segment: a tilde anywhere else is
+        // an ordinary character in a filename, and `~user` has no portable
+        // expansion so it stays literal and fails with the shell's message.
+        assert_eq!(quote_path("/tmp/~/x"), "'/tmp/~/x'");
+        assert_eq!(quote_path("~user/x"), "'~user/x'");
+
+        // And it reaches the script the remote shell is handed.
+        assert_eq!(
+            remote_script("claude", &args(["-p"]), Some(Path::new("~/repos/ai-app"))),
+            "cd \"$HOME\"/'repos/ai-app' && exec 'claude' '-p'",
+        );
+    }
+
     #[test]
     fn shell_metacharacters_cross_as_data_not_syntax() {
+        // Expanding $HOME must not open a door for anything else: the rest
+        // stays single-quoted, so this remains one absurd path rather than
+        // three commands.
+        assert_eq!(
+            quote_path("~/'; touch /tmp/pwned; '"),
+            r#""$HOME"/''\''; touch /tmp/pwned; '\'''"#,
+        );
+
         assert_eq!(quote("plain"), "'plain'");
         assert_eq!(quote("with space"), "'with space'");
         assert_eq!(quote("; rm -rf /"), "'; rm -rf /'");