Settings as a screen with two tabs, and fields that cost one line

The settings dialog had outgrown a dialog: it scrolled inside itself,
covered the session it is about, and had nowhere to put a second tab. It
is a screen now, drawn over the session like the file explorer so the
session under it stays composed, with the back gesture to leave it. The
second tab is ProviderScreen itself -- the same composable the machines
tab opens -- so a provider's settings have two ways in and one
implementation.

Every text field in the app goes through LabelledField: the label is a
line above the box rather than a thing floating inside it, the hint says
what leaving it blank means, and the padding is one line's worth.
Material's outlined field spends the height of three lines to hold one,
which on a form of a dozen settings is a screen and a half of scrolling.
The value's own text is unchanged -- the framing was what cost.

A session also gets a system prompt, which for llama.cpp is one entry in
the params table and no app change: it rides in front of the conversation
on every request rather than being recorded as the first thing in it, so
changing it takes effect on the next message. ParamKind::Prose is new
because a paragraph in a one-line box shows six words of itself.

TODO.md

@@ -22,33 +22,6 @@ one in place when it turns out to need a decision.
 
 ## Session settings
 
-Asked for by Bryan on 2026-09-21, in one run while other work was in flight.
-The first two are one change; the rest can land separately.
-
-- [ ] **A screen, not a modal.** The settings dialog has outgrown one: it
-      scrolls inside itself and covers the session it is about.
-
-- [ ] **Two tabs on that screen, the way the main screen has three.** One is
-      the session's own settings; the other is *the same provider screen*
-      reached from the machines tab (`ProviderScreen`), for this session's
-      provider -- two ways in, one screen, no second copy of the truth.
-
-- [ ] **Compact fields everywhere.** The label goes above the box rather than
-      floating inside it, and the padding around the value comes down. The
-      value's own text size does not change: what is costing a row its height
-      is the framing, not the text.
-
-- [ ] **A system prompt per session.** For llama.cpp it is a `system` message
-      on each request, so it is one entry in `DriverKind::params` and no app
-      change; whether the CLI drivers get one (`--append-system-prompt`) is a
-      separate question.
-
-- [ ] **Stop unloads the model where nothing else is using it.** Today
-      `Driver::stop` deliberately leaves it in memory, because the server is
-      the machine's and another session may be on the same model. The answer
-      is a claim per live session on the router, and an unload when the last
-      one goes -- not an unconditional unload.
-
 - [ ] Autocompact belongs in session settings; empty disables it, which is the
       default. Iris chose "hand it to the driver" — only where a driver has
       auto-compaction of its own. **That option was offered on a false premise