ui(managed-ne): replace import hint with help popover

Move bulk import and bastion/jump notes into a toolbar help popover to keep the action bar clean.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/i18n/en.ts

@@ -169,8 +169,19 @@ const en = {
     connectDetailTitle: "Connectivity test log",
     connectDetailEmpty:
       "No log yet. Run a connectivity test first; failures store full errors and hop context (passwords excluded).",
-    importHint:
-      "Import template includes optional hop columns (hop_enabled, etc.), or import NEs first then batch-add proxy. Password may be empty for bastion-managed targets.",
+    help:
+      "[Bulk import]\n" +
+      "· Required columns: device_type, ip, username, port, protocol, name, vendor. Download the template first.\n" +
+      "· password may be empty (required for direct login; optional for bastion-managed or batch proxy later).\n" +
+      "· Optional hop columns: hop_enabled, hop_vendor, hop_host, hop_port, hop_username, hop_password, hop_target_auth_mode, hop_command_template.\n" +
+      "· Or import NEs first, select rows, then use Batch add proxy.\n\n" +
+      "[Jump / bastion]\n" +
+      "· Bastion SSH username template: {hop_user}@{target_user}@{target_ip}@{hop_host}; target account = NE Username.\n" +
+      "· Bastion-managed: set Jump password (Vault); target password optional. Manual mode needs target password.\n" +
+      "· JumpServer/CBH often use port 2222; some sites use 22.\n\n" +
+      "[Connectivity / edit]\n" +
+      "· NETX_CREDENTIAL_SECRET_KEY required to store passwords.\n" +
+      "· Leave password blank on edit to keep unchanged; open Details after failed connect-test for hop context (no secrets).",
     importResult: {
       done: "Import done: {{inserted}} inserted, {{updated}} updated, {{failed}} failed row(s)",
     },
@@ -187,8 +198,6 @@ const en = {
       deleted: "Network element deleted",
       passwordRequired: "Password is required",
       passwordOptional: "leave blank to keep unchanged",
-      passwordHint:
-        "Required for direct login; leave empty when bastion manages target credentials. Use batch proxy later.",
     },
     hop: {
       sectionTitle: "Jump host / proxy",

web/src/i18n/zh.ts

@@ -167,8 +167,19 @@ const zh = {
     connectDetail: "详情",
     connectDetailTitle: "连通性测试日志",
     connectDetailEmpty: "暂无日志。请先执行连通性测试；失败时会记录完整错误与跳板上下文（不含密码）。",
-    importHint:
-      "导入模板含可选跳板列（hop_enabled 等）；也可先导入网元再批量添加代理。密码可留空（堡垒机托管场景）。",
+    help:
+      "【批量导入】\n" +
+      "· 必填列：device_type、ip、username、port、protocol、name、vendor；可先下载模板。\n" +
+      "· password 可留空（直连需填；堡垒机托管或后续批量添加代理时可空）。\n" +
+      "· 可选跳板列：hop_enabled、hop_vendor、hop_host、hop_port、hop_username、hop_password、hop_target_auth_mode、hop_command_template。\n" +
+      "· 也可先导入网元，勾选后点「批量添加代理」统一配置跳板。\n\n" +
+      "【跳板 / 堡垒机】\n" +
+      "· 堡垒机 SSH 用户名模板：{hop_user}@{target_user}@{target_ip}@{hop_host}；目标账号填网元「用户名」。\n" +
+      "· 堡垒机托管时填「跳板密码」（Vault 密码），目标密码可留空；手动模式需填目标密码。\n" +
+      "· JumpServer/CBH 常用跳板端口 2222，部分现场为 22。\n\n" +
+      "【连通性 / 编辑】\n" +
+      "· 保存密码需配置 NETX_CREDENTIAL_SECRET_KEY。\n" +
+      "· 编辑时密码留空表示不修改；连通性失败请点「详情」查看 hop 上下文（不含密码）。",
     importResult: {
       done: "导入完成：新增 {{inserted}}，更新 {{updated}}，失败 {{failed}} 行",
     },
@@ -185,7 +196,6 @@ const zh = {
       deleted: "网元已删除",
       passwordRequired: "请填写密码",
       passwordOptional: "留空则不修改",
-      passwordHint: "直连网元需填写；经堡垒机托管时可留空，后续可用「批量添加代理」统一配置跳板。",
     },
     hop: {
       sectionTitle: "跳板 / 代理",