feat(ssh): tunnel cards, in-place tunnel creation, startup commands

[attson]

Summary

• Tunnels tab is now a card grid matching Hosts and Keys, with the state pill and actions stacked in the card's right column so the route text keeps a full line.
• Tunnels can be created, edited and deleted from the Tunnels tab. The new drawer picks the SSH host the tunnel rides — the bastion, when the target is behind one — and saves the rule onto that host. Saving does not open a listener; there is a separate "Save and start".
• Hosts gain a startup command: lines typed at whatever prompts a bastion shows before handing over a shell. Built for JumpServer, which asks for the asset at Opt> and then the system user at ID>. Each line is followed by a separate carriage return — "text\r" in one write reads as a paste to a program in raw mode (the bug this repo has re-fixed three times on the quick-template path, fix quick input enter dispatch #63 / chore(desktop): remove the legacy quickInput plugin (superseded by QuickTemplate) #110 / fix(templates): split text and Enter so Codex reads them as keystrokes, not paste #129).
• Tag field commits on blur. Leaving by anything other than Enter or comma used to silently discard the typed tag.
• Key drawer can reveal the stored private key behind an eye button (fetched on demand via a new RevealSSHKey binding, never on open), with a copy button beside it.

Notes on two deliberate choices

SSHConnectReq.StartupCommand is tagged json:"-". It types arbitrary input into a remote shell, so only NewSshSessionByID fills it from a saved host — a marshalled field would make "type this into that machine" part of the bound-method surface NewSshSession exposes to the frontend.

Every tunnel write sends the whole host record. UpdateSSHHost lets the caller's value win for UI-owned fields, so a payload built from the rule alone would clear the rest of the host — the same shape as the item-25 bug that stripped proxy_jump.

Test plan

• go test ./desktop/... passes (4 packages)
• go vet ./desktop/... clean
• npx vitest run passes (177 files / 2347 tests; SshHostsPanel.test.ts 93 → 108)
• npx vue-tsc --noEmit clean
• vite build succeeds
• Tunnels tab renders as cards; start / stop / dismiss still work on a live tunnel
• New Tunnel drawer: pick a host, save, confirm the rule appears under that host and the host's other fields survive
• "Save and start" brings the listener up on the rule just created
• Edit a tunnel: host picker is locked, save replaces rather than appends
• Delete a running tunnel: listener stops before the rule is removed
• Host drawer: type a two-line startup command against a JumpServer bastion, confirm it lands on the target machine
• Startup command survives an unrelated host edit; clearing it sticks
• Tag field: type a tag, click elsewhere, confirm the chip appears and saves
• Key drawer: eye button reveals the stored PEM, second click clears it, copy button works