Network: Add "Forget saved password" UI for SMB

- `ShareBrowser` header row button when stored creds are active
- `NetworkBrowser` right-click → confirm dialog on hosts with stored creds
- Shared `forgetCredentials()` in `network-store` wires up the previously unused `deleteSmbCredentials`
- Haven't tested TBH, in the lack of a suitable server

Author: vdavid

apps/desktop/src/lib/file-explorer/network/CLAUDE.md

@@ -46,6 +46,7 @@ Key exported functions:
 | `refreshSharesIfStale(host)`                | Background refresh if TTL expired                   |
 | `refreshAllStaleShares()`                   | Call on entering network view                       |
 | `checkCredentialsForHost(serverName)`       | One-time async Keychain probe; idempotent           |
+| `forgetCredentials(serverName)`             | Deletes stored creds, sets status to `no_creds`     |
 | `setCredentialStatus / getCredentialStatus` | In-memory only, not persisted                       |
 | `setShareState / clearShareState`           | Used by `ShareBrowser` after successful auth        |
 | `getDiscoveryState()`                       | Returns current `DiscoveryState`                    |
@@ -67,6 +68,9 @@ encoded into the synthetic `name` field so MCP agents can read IP, hostname, sha
 
 Exported for parent: `setCursorIndex(index)`, `findItemIndex(name)`, `handleKeyDown(e)`.
 
+Right-click on a host row with stored credentials shows a confirmation dialog to forget the saved password (calls
+`forgetCredentials`).
+
 ## `ShareBrowser.svelte`
 
 Rendered after user selects a host. Auth flow on mount:
@@ -81,6 +85,9 @@ Rendered after user selects a host. Auth flow on mount:
 
 `authenticatedCredentials` is passed to `onShareSelect` so the caller can mount the share without re-prompting.
 
+When `authenticatedCredentials` is set (stored creds were used), a "Forget saved password" button appears in the header
+row. Clicking it calls `forgetCredentials` and clears `authenticatedCredentials`.
+
 Shares displayed sorted case-insensitively. Escape/Backspace go back to host list.
 
 ## `NetworkLoginForm.svelte`
@@ -157,8 +164,10 @@ status into the name string is a workaround so MCP agents can read the same info
 ## Dependencies
 
 - `$lib/tauri-commands` — `listNetworkHosts`, `resolveNetworkHost`, `listSharesOnHost`, `listSharesWithCredentials`,
-  `prefetchShares`, `getSmbCredentials`, `saveSmbCredentials`, `getUsernameHints`, `getKnownShareByName`,
-  `updateKnownShare`, `updateLeftPaneState`, `updateRightPaneState`
+  `prefetchShares`, `getSmbCredentials`, `saveSmbCredentials`, `deleteSmbCredentials`, `getUsernameHints`,
+  `getKnownShareByName`, `updateKnownShare`, `updateLeftPaneState`, `updateRightPaneState`
 - `$lib/settings/network-settings` — `getNetworkTimeoutMs`, `getShareCacheTtlMs`
+- `$lib/utils/confirm-dialog` — `confirmDialog` (used by `NetworkBrowser` for forget-password confirmation)
+- `$lib/ui/toast` — `addToast` (feedback after credential operations)
 - `../navigation/keyboard-shortcuts` — `handleNavigationShortcut`
 - `../types` — `NetworkHost`, `DiscoveryState`, `ShareInfo`, `ShareListResult`, `ShareListError`, `AuthMode`

apps/desktop/src/lib/file-explorer/network/NetworkBrowser.svelte

@@ -19,11 +19,14 @@
         fetchShares,
         getCredentialStatus,
         checkCredentialsForHost,
+        forgetCredentials,
     } from './network-store.svelte'
     import { tooltip } from '$lib/tooltip/tooltip'
     import type { NetworkHost } from '../types'
     import { updateLeftPaneState, updateRightPaneState, type PaneState, type PaneFileEntry } from '$lib/tauri-commands'
     import { handleNavigationShortcut } from '../navigation/keyboard-shortcuts'
+    import { confirmDialog } from '$lib/utils/confirm-dialog'
+    import { addToast } from '$lib/ui/toast'
 
     /** Row height for host list (matches Full list) */
     const HOST_ROW_HEIGHT = 20
@@ -347,6 +350,21 @@
         return undefined
     }
 
+    async function handleHostContextMenu(e: MouseEvent, host: NetworkHost) {
+        e.preventDefault()
+        if (getCredentialStatus(host.name) !== 'has_creds') return
+
+        const confirmed = await confirmDialog(`Remove saved password for "${host.name}"?`, 'Forget saved password')
+        if (!confirmed) return
+
+        try {
+            await forgetCredentials(host.name)
+            addToast(`Forgot saved password for ${host.name}`, { level: 'info' })
+        } catch {
+            addToast(`Couldn't delete saved password`, { level: 'error' })
+        }
+    }
+
     // Refresh all shares (user-initiated)
     function handleRefreshClick() {
         // Clear all share states to force refetch
@@ -383,6 +401,9 @@
                 ondblclick={() => {
                     handleHostDoubleClick(index)
                 }}
+                oncontextmenu={(e: MouseEvent) => {
+                    void handleHostContextMenu(e, host)
+                }}
                 onkeydown={() => {}}
             >
                 <span class="col-name">

apps/desktop/src/lib/file-explorer/network/ShareBrowser.svelte

@@ -13,6 +13,7 @@
         clearShareState,
         setShareState,
         setCredentialStatus,
+        forgetCredentials,
     } from './network-store.svelte'
     import {
         listSharesWithCredentials,
@@ -22,6 +23,7 @@
         updateKnownShare,
     } from '$lib/tauri-commands'
     import { addToast } from '$lib/ui/toast'
+    import { tooltip } from '$lib/tooltip/tooltip'
     import { getNetworkTimeoutMs, getShareCacheTtlMs } from '$lib/settings/network-settings'
     import NetworkLoginForm from './NetworkLoginForm.svelte'
     import { handleNavigationShortcut } from '../navigation/keyboard-shortcuts'
@@ -380,6 +382,16 @@
         return false
     }
 
+    async function handleForgetPassword() {
+        try {
+            await forgetCredentials(host.name)
+            authenticatedCredentials = null
+            addToast(`Forgot saved password for ${host.name}`, { level: 'info' })
+        } catch {
+            addToast(`Couldn't delete saved password`, { level: 'error' })
+        }
+    }
+
     function handleRetry() {
         error = null
         showLoginForm = false
@@ -432,6 +444,15 @@
         <div class="header-row">
             <Button variant="secondary" size="mini" onclick={onBack}>← Back</Button>
             <span class="host-name">{host.name}</span>
+            {#if authenticatedCredentials}
+                <button
+                    class="forget-password-btn"
+                    onclick={handleForgetPassword}
+                    use:tooltip={'Remove saved password from Keychain'}
+                >
+                    🔑 Forget saved password
+                </button>
+            {/if}
             <span class="share-count">{sortedShares.length} {sortedShares.length === 1 ? 'share' : 'shares'}</span>
         </div>
         <div class="share-list" bind:this={listContainer} bind:clientHeight={containerHeight}>
@@ -522,6 +543,26 @@
         color: var(--color-text-primary);
     }
 
+    .forget-password-btn {
+        display: flex;
+        align-items: center;
+        gap: var(--spacing-xs);
+        padding: 1px var(--spacing-sm);
+        font-family: var(--font-system), sans-serif;
+        font-size: calc(var(--font-size-sm) * 0.9);
+        color: var(--color-text-tertiary);
+        background: none;
+        border: 1px solid transparent;
+        border-radius: var(--radius-sm);
+        cursor: pointer;
+    }
+
+    .forget-password-btn:hover {
+        color: var(--color-text-secondary);
+        border-color: var(--color-border);
+        background-color: var(--color-bg-tertiary);
+    }
+
     .share-count {
         color: var(--color-text-tertiary);
         margin-left: auto;

apps/desktop/src/lib/file-explorer/network/network-store.svelte.ts

@@ -12,6 +12,7 @@ import {
     listSharesOnHost,
     prefetchShares as prefetchSharesCmd,
     getSmbCredentials,
+    deleteSmbCredentials,
 } from '$lib/tauri-commands'
 import { getNetworkTimeoutMs, getShareCacheTtlMs } from '$lib/settings/network-settings'
 import { initializeSettings } from '$lib/settings'
@@ -375,3 +376,12 @@ export async function checkCredentialsForHost(serverName: string): Promise<void>
         credentialStatuses.set(key, 'no_creds')
     }
 }
+
+/**
+ * Delete stored credentials for a host and update status.
+ * Removes server-level credentials from the Keychain/credential store.
+ */
+export async function forgetCredentials(serverName: string): Promise<void> {
+    await deleteSmbCredentials(serverName, null)
+    credentialStatuses.set(serverName.toLowerCase(), 'no_creds')
+}