feat: Phase 2 Security Enhancement
- pkg/crypto: AES-256-GCM encryption with PBKDF2 key derivation
- 100k iterations, 16-byte salt, SHA-256
- Encrypt/Decrypt/IsEncrypted/HashPassword
- Storage layer encryption:
- JSONStorage.SetPassword() enables transparent encrypt/decrypt
- readJSON auto-decrypts, replace* auto-encrypts
- pkg/knownhosts: TOFU host key verification
- Verify/Add/Remove host keys
- HostKeyCallback for SSH config
- SSH client security:
- SetHostKeyCallback() replaces InsecureIgnoreHostKey()
- SetPassphraseCallback() for encrypted private keys
- getKeySigner() tries passphrase on encrypted keys
- Models: AppConfig gains EncryptionEnabled, PasswordHash, KnownHostsFile
swanadiva
611b794fc7