Name a non-default database in the TUI footer

[MJohnson459]

The TUI footer now names the database this run opened, whenever it is not the
operator's own store.

What changed

draw_status (crates/voro/src/ui.rs) splits its row the way draw_header
splits its own — Layout::horizontal([Constraint::Min(0), Constraint::Length(w)])
— and renders the store's path dim at the right. status_height is untouched;
the row never grows a line for it. A status message still returns early and owns
the row whole, wrapped, with the indicator suppressed rather than right-aligned
against text whose margin moves.

Two helpers carry the logic. db_indicator(path, budget) returns None when the
path is Store::production_db_path() and the shortened path otherwise; the
comparison is against the production path rather than default_db_path(),
which is the crux of the change — the default for a target/ build is
dev.db, so an indicator keyed on it would stay silent in exactly the case that
motivated the task. That is the rule db_flag and seed_verb already follow.
shorten_store_path(path, home, budget) is pure: ~ for the home directory,
then leading directories surrendered whole for a leading …, so the filename
and its parent — the half that identifies the store — survive.

The budget is not the row. The key line is measured first and the indicator
takes only what is left, because the line's eleven-slot budget is fixed and
documented (DESIGN.md §9) while a store path's length is not, so the occupant
that cannot be bounded is the one that yields. The ladder therefore ends at the
bare filename and then at nothing at all, rather than at a name cut mid-word: a
fragment identifies no store, and those columns are the key line's to have back.
Absence is not neutral — an empty right margin means the operator's own store —
so vanishing is the last rung, and a filename longer than the leftover is the one
case where the row loses information, which is preferable to spending the line's
recovery keys on half a name.

App::db_path() was added beside config_path(); nothing new is plumbed through
App::new or ui::draw. key_hints and hint_candidates are unchanged.

DESIGN.md §9 gains a paragraph on the indicator — what it shows, that it is keyed
on the production path rather than on whichever store the binary defaults to, and
that the row is sized against the key line's budget rather than against the path
— and §5's "Which database a build opens" paragraph gains a cross-reference.

Verification

cargo test --workspace (883 tests), cargo clippy --workspace --all-targets -- -D warnings, and cargo fmt --all are clean. Six new tests: the production path
yields None while the dev path and an arbitrary scratch path yield Some; home
substitution; shortening into a leftover budget rather than a share of the row;
the bottom of the ladder (bare filename, then None, never a mid-word cut); a
TestBackend render asserting through screen_text that the footer carries the
store, that a status message displaces it, and that a key line and a store which
both fit are both whole; and a render at 110x24 on the widest key line the app
can produce — a review task with a branch, a PR and a session, on both screens
that show it — asserting every slot through q quit survives.

Verified live with the verify skill in tmux. At 110x30 on a deep scratch store
all four screens keep every slot including ? keys and q quit, the Config
screen's longest line degrading the indicator to voro.db; widening to 130 and
160 columns brings the path back progressively (…/scratch/store/voro.db, then
…/jobs/…/store/voro.db). The same binary with no --db shows
…/share/voro/dev.db. A store at the production path — verified by redirecting
XDG_DATA_HOME, so the operator's real store was never opened — shows nothing at
all, and the key line has the full row. Pressing o on a ready task puts the
refusal on the row alone.

Commits

Two, on footer-db-indicator: 396cac0 adds the indicator, 9413bce folds in
task #456 (sizing it from the key line's leftover). Both belong to this change
and reach main together.