app: show the server by the name its operator handed out

The Server URL field showed the endpoint the app dials, which after
discovery is not the name anyone was given — enrolling against
fmr.echo-lot.app left the settings reading fmr-1.echo-lot.app, with no
explanation of where the -1 came from.

It shows the public name now. The endpoint is not hidden, just demoted to
a line beneath that says where the connection actually goes and why the
two differ: a network engineer debugging a failed connection wants that,
and burying it would trade one confusion for another.

Typing a URL by hand sets both, since there is no discovery to consult in
that case — setting only the public one would leave the app still dialling
the previous server, which is the kind of half-applied change that fails
much later and somewhere else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

echolot-app/app/src/main/kotlin/app/echo_lot/app/SettingsScreen.kt

@@ -67,14 +67,17 @@ fun SettingsScreen(
     var privacy by remember { mutableStateOf(settings.privacyLevel) }
     var stableSalt by remember { mutableStateOf(settings.stableSalt) }
     var enrollLink by remember { mutableStateOf("") }
-    var serverUrl by remember { mutableStateOf(settings.serverUrl) }
+    // The public name, which is what the operator handed out and what a person recognises. The
+    // endpoint actually dialled is shown beneath it when the two differ, rather than hidden — a
+    // network engineer debugging a connection wants to see where it really goes.
+    var serverUrl by remember { mutableStateOf(settings.serverPublicUrl) }
     var serverPin by remember { mutableStateOf(settings.serverPin) }
     var serverCred by remember { mutableStateOf(settings.serverCredential) }
     // Enrolling is asynchronous, so these are re-read when its result lands rather than when the
     // button is pressed — reading them immediately showed the previous server's values and looked
     // exactly like an enrollment that had silently done nothing.
     androidx.compose.runtime.LaunchedEffect(enrollStatus) {
-        serverUrl = settings.serverUrl
+        serverUrl = settings.serverPublicUrl
         serverPin = settings.serverPin
         serverCred = settings.serverCredential
     }
@@ -237,9 +240,25 @@ fun SettingsScreen(
                 }
 
                 OutlinedTextField(
-                    value = serverUrl, onValueChange = { serverUrl = it; settings.serverUrl = it },
+                    value = serverUrl,
+                    onValueChange = {
+                        serverUrl = it
+                        // Typed by hand there is no discovery to consult, so what was entered is
+                        // both the public name and the endpoint. Setting only one of them would
+                        // leave the app dialling the previous server.
+                        settings.serverUrl = it
+                        settings.serverPublicUrl = it
+                    },
                     label = { Text("Server URL") }, singleLine = true, modifier = Modifier.fillMaxWidth(),
                 )
+                if (settings.serverUrl.isNotBlank() && settings.serverUrl != settings.serverPublicUrl) {
+                    Text(
+                        "Connects to ${settings.serverUrl} — this server publishes one name and " +
+                            "points devices at another, so its pinned certificate can share a port " +
+                            "with its web interface.",
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
                 OutlinedTextField(
                     value = serverPin, onValueChange = { serverPin = it; settings.serverPin = it },
                     label = { Text("Certificate pin (SPKI, base64)") }, singleLine = true,