[groupsky]

What

nodkey ssh-grant --key NAME --user USER --host NAME... --for DURATION [--reason TEXT]: one tap pre-approves SSH logins as one user to a list of hosts for N minutes, for example one Ansible run (DESIGN.md section 13, decision 4).

• The message lists the key, the user, every host and the end time. After the tap, logins through nodkey ssh-agent to exactly those hosts (all their host keys), as that user, with that key, need no further tap until the end shown. Other hosts, users, keys and clients still ask.
• The broker refuses (before any message): a bad user name; a key whose rule is not window; --for longer than the key's window; a host not in known_hosts or not in the key's hosts; 0 or more than 20 hosts; an unknown key or one the client may not use.
• Grants now end at the start of the second that the message shows (also "Approve N min" grants). A client that hangs up right after the tap starts no grants.
• The client follows the answer rules of nodkey run; its last line is, for example, nodkey: SSH logins as deploy to 2 hosts allowed until 14:20 (exit 0).

Tests

Against the real broker service over mutual TLS with the fake approver: approve (then logins to the listed hosts are signed without a tap and others ask), deny, expiry, cancel, signals, every broker refusal (also raw requests the client would never send), look-alike host names, duplicates, a reason that tries to fake verified lines, a Deny that ends the grants, the end time to the second, a hang-up after the tap; golden tests of the message. Stress runs pass on Go 1.27 and 1.26. Also fixes two flaky tests (TestRunInterrupted, TestHangUpBeforeSign).

Docs

DESIGN.md sections 9, 13 and 15; THREAT-MODEL.md T1 and T8; AGENTS.md layout.

Review

Two rounds with the security-reviewer agent; the last said "ready to commit". No grant reaches another host, user, key or client, lasts longer than shown, or survives a Deny.

Closes #14