feat: Phase 2 Security Enhancement

- pkg/crypto: AES-256-GCM encryption with PBKDF2 key derivation
  - 100k iterations, 16-byte salt, SHA-256
  - Encrypt/Decrypt/IsEncrypted/HashPassword
- Storage layer encryption:
  - JSONStorage.SetPassword() enables transparent encrypt/decrypt
  - readJSON auto-decrypts, replace* auto-encrypts
- pkg/knownhosts: TOFU host key verification
  - Verify/Add/Remove host keys
  - HostKeyCallback for SSH config
- SSH client security:
  - SetHostKeyCallback() replaces InsecureIgnoreHostKey()
  - SetPassphraseCallback() for encrypted private keys
  - getKeySigner() tries passphrase on encrypted keys
- Models: AppConfig gains EncryptionEnabled, PasswordHash, KnownHostsFile

internal/models/models.go

@@ -59,6 +59,20 @@ type AppConfig struct {
 	Editor            string `json:"editor"`
 	AutoSync          bool   `json:"auto_sync"`
 	SyncProvider      string `json:"sync_provider,omitempty"`
+
+	// Security
+	EncryptionEnabled bool   `json:"encryption_enabled"`
+	PasswordHash      string `json:"password_hash,omitempty"` // SHA-256 hash for verification
+	KnownHostsFile    string `json:"known_hosts_file,omitempty"`
+}
+
+// KnownHost represents a verified host key
+type KnownHost struct {
+	Hostname string `json:"hostname"`
+	Port     int    `json:"port"`
+	KeyType  string `json:"key_type"`  // "ssh-rsa", "ssh-ed25519", etc.
+	KeyHash  string `json:"key_hash"`  // Base64-encoded host key
+	AddedAt  time.Time `json:"added_at"`
 }
 
 // DefaultConfig returns the default application configuration
@@ -70,5 +84,6 @@ func DefaultConfig() *AppConfig {
 		Theme:             "dark",
 		Editor:            "vim",
 		AutoSync:          false,
+		EncryptionEnabled: false,
 	}
 }