feat(M38): SSH target connector for agentless deployment via SSH/SFTP

Adds a new target connector enabling certificate deployment to any
Linux/Unix server without installing the certctl agent binary. Uses the
proxy agent pattern — a single agent in the same network zone deploys
certs to remote servers over SSH/SFTP.

Key additions:
- SSH/SFTP connector with key auth (file/inline) + password auth
- Injectable SSHClient interface for cross-platform testing (25 tests)
- Shell injection prevention via validation.ValidateShellCommand()
- Configurable cert/key/chain paths with octal permissions
- GUI: 11 SSH config fields in target create wizard

Also fixes pre-existing frontend bug where all target type strings
(nginx, apache, etc.) were sent as lowercase but the backend expects
proper-case (NGINX, Apache, etc.), breaking GUI-created targets.
Adds missing TargetTypeSSH to validTargetTypes service map.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/src/pages/TargetDetailPage.tsx

@@ -11,16 +11,17 @@ import { formatDateTime } from '../api/utils';
 import type { Job } from '../api/types';
 
 const typeLabels: Record<string, string> = {
-  nginx: 'NGINX',
-  apache: 'Apache',
-  haproxy: 'HAProxy',
-  traefik: 'Traefik',
-  caddy: 'Caddy',
-  f5_bigip: 'F5 BIG-IP',
-  iis: 'IIS',
-  envoy: 'Envoy',
-  postfix: 'Postfix',
-  dovecot: 'Dovecot',
+  NGINX: 'NGINX',
+  Apache: 'Apache',
+  HAProxy: 'HAProxy',
+  Traefik: 'Traefik',
+  Caddy: 'Caddy',
+  F5: 'F5 BIG-IP',
+  IIS: 'IIS',
+  Envoy: 'Envoy',
+  Postfix: 'Postfix',
+  Dovecot: 'Dovecot',
+  SSH: 'SSH',
 };
 
 function InfoRow({ label, value }: { label: string; value: React.ReactNode }) {