feat: mount spaces/folders over SFTP with SSH-key auth

Add an in-process SFTP server (russh) backed directly by the nodes
table, so a space can be edited from nvim or synced with sshfs without
a separate filesystem mirror. Access is authenticated by public key
against a new ssh_keys table, managed via :sshkey in the app; the
feature stays off until WORKSPACE_SFTP_BIND is set.

web/src/lib/api.ts

@@ -30,6 +30,15 @@ export interface WorkspaceNode extends NodeSummary {
   path: Crumb[]
 }
 
+/** A public key allowed to mount the workspace over SFTP. */
+export interface SshKey {
+  id: number
+  name: string
+  fingerprint: string
+  created_at: number
+  last_used_at: number | null
+}
+
 export interface SharedDocument {
   name: string
   body: string
@@ -248,4 +257,11 @@ export const api = {
 
   readShared: (token: string, key: string) =>
     request<SharedDocument>(`/share/${encodeURIComponent(token)}/${encodeURIComponent(key)}`),
+
+  listSshKeys: () => request<SshKey[]>('/ssh-keys'),
+
+  addSshKey: (name: string, public_key: string) =>
+    request<SshKey>('/ssh-keys', { method: 'POST', body: body({ name, public_key }) }),
+
+  removeSshKey: (id: number) => request<{ ok: true }>(`/ssh-keys/${id}`, { method: 'DELETE' }),
 }