Add an embedded ephemeral SSH agent backend

[masahide]

Summary

• add a selectable embedded ephemeral SSH agent backend backed by the concurrent in-memory Go keyring
• expose the standard Windows OpenSSH Named Pipe in embedded mode with a current-user/SYSTEM ACL and connection-aware shutdown
• connect OpenSSH, Pageant, and Cygwin/MSYS2 interfaces to the same embedded backend
• add the backend selector, embedded-mode warnings, tests, and updated architecture/migration documentation

Security model

• keys are retained only by the OmniSSHAgent process and are not reloaded after restart
• private-key paths and decryption passphrases are not persisted
• confirm-before-use constraints are rejected instead of silently ignored
• Windows OpenSSH remains the default backend, and OmniSSHAgent never stops or disables its service automatically

Validation

• go test -count=1 ./...
• go vet ./...
• ./scripts/test-installer.ps1
• amd64 console build
• amd64 windowsgui build
• arm64 windowsgui build
• go mod tidy with no module-file changes
• manual Settings visual QA
• manual KeePassXC unlock/lock E2E
• hosted CI (Windows run 33073972572)

Fixes #79

[flameshikari]

I compiled and tested it myself in this branch, and everything works good. Thank you so much for the quick response and fix. By the way, GitHub Actions didn't work yesterday, so you probably need to restart your worfklow for the tests to pass.