fix(ssh): complete M2 key selection, approval, and setup UX

[theogravity]

SSH Anywhere M2 could use another machine's keys through its backend, but Connect had no way to select that machine. The browser now offers Use SSH keys from, defaults to the connecting machine's own keys, and explains first-use approval with a return path that preserves the connection choices. Approving never auto-launches; the user returns and clicks Connect again.

SSH settings now distinguish loading, failed reads, and empty lists, with retry controls and clearer explanations of key permissions and host trust. Approval cards avoid linking to a pane that has not been created and expose the exact destination account and port for return navigation.

Set up Subshell here reports server-observed checking, installing, and waiting-for-connection stages. Users can close the dialog or refresh the browser and resume viewing the same operation. Duplicate submissions join the existing operation rather than starting another install. Status is owner-scoped and contains no installer output or credentials. Completed status is retained for one hour in the server process; it does not survive a server restart.

Validation:

• Full repository tests: 54/54 tasks passed, including 4,311 server tests.
• Full type checking, lint, prose, and design-system checks passed.
• Real SSH relay e2e passed, including destination enrollment, revocation, and host-key recovery.
• New browser journey passed: choose remote keys, request approval, approve, return with the same account/host/port and key machine, then explicitly retry.
• Component and service tests cover read failures, unavailable key machines, closing/reopening setup, duplicate-install prevention, owner-only status, safe errors, and status expiry.

Stack: #333 → #334 → #336 → #337 → #338 → this PR. Base is feat/ssh-anywhere-m2; this PR contains only the UX follow-up. Do not merge before its parent.