Header breaks when the endpoint host is long, and shows the full access key

Connect to the Jetstream proxy at `sparcd-quic-proxy-03.bio260073.projects.jetstream-cloud.org` and the connection chip runs past the width of the header. The "complete" state pill gets pushed onto its own line above the bar. The same header also prints the full access key: it shows the masked key, then the identity right after it, and identity defaults to the raw access key.

Where:

- `packages/auth-ui/src/ConnectionChip.tsx:17-22` `hostOf` strips the scheme and port but the span at line 63 has no width limit
- `packages/auth-ui/src/ConnectionChip.tsx:25-28` `maskKey` renders `AK…90` at line 69, and line 77 renders `identity` unmasked two spans later
- `apps/sparcd-uploader/src/components/Chrome.tsx:37` header is `flex-wrap` with `md:h-14 md:flex-nowrap`, so a wide child forces the wrap; lines 74-76 render `StatePill` then `ConnectionChip identity={uploaderUser}`
- `apps/sparcd-uploader/src/store.ts:293` defaults `uploaderUser` to the access key, same at 651 and 659
- `apps/sparcd-tagger/src/components/Chrome.tsx:125` has the same call

What to do:

1. Give the host span a max width with ellipsis truncation and put the full host in a `title` tooltip.
2. Stop defaulting the identity to the raw access key. Leave it blank until the user types a name, so the chip shows the masked key alone.
3. Check both headers at a narrow viewport with the long Jetstream host.

Done when:

- [ ] Long host truncates instead of wrapping the header
- [ ] Full host readable on hover
- [ ] The access key appears once, masked
- [ ] The state pill stays on the header row in both apps

Related: CulverLab/sparcd-requirements#37 operator user story, #198 meeting notes.

Serves user story: RAJ1, M2, BRU1