Models & Hosts UI: misleading NodeLink states

UI issues seen while bringing up a new co-located Gmind node (prod aws1) and testing NodeLink (Task 5543). One requirement per line. 1. **Models: account-level "no credentials" badge.** When ONE node reports `no_credentials` for an account (a new node still provisioning), every account row gets a "no credentials" badge, though it is `ok` and busy on four other nodes. Show the badge only when no node can serve the account, or name the node ("no credentials on aws1"). 2. **Models: a provisioning node.** A new node's accounts show `pending`, then the account-level "no credentials", for many minutes. Show a single "provisioning" state on that node's row until its first successful probe. 3. **Hosts: "Add node failed" with nothing to open.** The host badge says "Adding a node failed. Open it to retry", but the host lists 0 nodes and `/nodes/<name>` is "Node not found". Keep the failed node visible on the host page with its failure reason and a Retry action. 4. **Hosts: a host that cannot run co-located nodes.** An old cloud host (booted 24.04, no rootless docker) accepts Add node and fails every time with "The node couldn't start on its host". Say up front that this host must be re-created, or refuse Add node with that reason. 5. **Add node: a host name blocks the node name.** "aws1" was refused as "already taken" because a host had that name, with no node by that name anywhere. Say what holds the name ("a host is named aws1"). 6. **Models: row expand toggles.** Clicking an expanded account row's name collapses it with no visible affordance. Keep the +/− control as the only toggle, or give the whole row a pointer and aria-expanded. Out of scope: NodeLink mount and preflight behaviour (Task 5543), and anything already in Task 5596. Done means: - Each item is fixed, or rejected with a reason in the PR body. - Screenshots in the report of Models (an account `ok` on some nodes and provisioning on one) and of a host with a failed node.

Items 1–5 fixed: Models shows the account "no credentials" badge only when no node holds a session, and a new node shows "provisioning". A failed Add node stays on the host page with Retry, a host with no rootless engine refuses Add node, and a taken name says a host holds it. Item 6 rejected: +/− is already the only toggle. Full gate green, Jaah Deploy OK. 7 UI follow-ups are listed in the PR body.