feat: group the board by host and paint it at once

[tensorcopy]

Read the diff as the last six commits. This pull request is stacked on #6, #7 and #8. Until they merge, the diff above includes their commits — GitHub requires a pull request's base branch to live on this repository, so a cross-fork stack cannot be based on one another's branches. Once #8 merges, this diff shrinks to exactly its own six commits (grouping, freshness, the image allowlist, the docs, and two review fixes). Merge order for the series: #6 → #7 → #8 → this one. Draft until then so it cannot merge out of order; the code is final and ready to review now.

Why. With several hosts on one board the lists interleaved. Opening the surface waited on a full GitHub sweep. A board could sit minutes behind GitHub. And an enterprise repository's screenshots rendered as links, because the image proxy only knew github.com.

What.

• With more than one host on the board, the list is divided into one section per host, in the order the active sort puts their first card. A single host draws no banner.
• The board cache gained single-flight, disk persistence and stale-while-revalidate: an expired board is served at once, marked stale on the wire, and refreshed behind the surface, and the client refetches a stale answer shortly after. The TTL drops to one minute, and a sweep in which a column failed is not cached. The header says how old the board on screen is.
• Attachments on every authenticated host are proxied, each fetched with that host's own token (gh auth token --hostname). The allowlist names no host itself: github.com plus the hosts gh auth status reports, all under /user-attachments/ only. The githubusercontent CDNs carry the github.com token — those CDNs being github.com's own image hosting — and a hop the allowlist refuses, such as the signed redirect leg, carries no header at all: a presigned URL answers 400 to a request that also carries an Authorization header, verified against a live attachment. An enterprise token never leaves its own host.
• The host override outside an item's context is GH_HOST alone: a settings-file hostname key was read but never written or documented, and the next settings save silently erased it.
• CHANGELOG entries under [Unreleased], and the README paragraphs and limitation updates that match.

How. client/board/host-sections.ts groups already-sorted rows without disturbing the order within a group; the Cache class in server/cache/ gained revalidate, shouldCache and patchAll; shared/image-host.ts takes the authenticated hosts as a parameter and both halves pass the same list — the daemon from its accounts, the client from the board answer's imageHosts field.

Test. 14 suites, 70 tests at this tip, covering the cache revalidation and freshness, the host sections, the allowlist and the per-host token mapping. Typecheck and lint are clean, and every commit in the stack builds and passes its tests on its own.