Fix ApproveFingerprint: extract real host key via SSH instead of writing fingerprint SHA256 to known_hosts

The old ApproveFingerprint passed the SHA256 fingerprint string to
AddKnownHost which expected authorized_key format, causing known_hosts
entries to be corrupted and subsequent SSH connections (including shutdown)
to fail with "host key not found".

Changes:
- dialSSH now returns (conn, fingerprint, pubKey, error) with the raw
  ssh.PublicKey captured from the server
- New ConnectForApproval() wraps dialSSH with strictHostKeyChecking=false
  for the approval handshake
- ApproveFingerprint now opens an SSH connection to the host (non-strict),
  captures the real public key, and writes it in authorized_keys format
  to known_hosts via AddKnownHost
- shutdown.go updated to handle the new 4-value dialSSH return
- Supports optional host_key field in request body for direct key submission

internal/sshmanager/shutdown.go

@@ -14,7 +14,7 @@ type ShutdownResult struct {
 }
 
 func RunRemoteCommand(ctx context.Context, host string, port int, user, privKeyPath, knownHostsPath string, strictHostKeyChecking bool, command string) (*ShutdownResult, error) {
-	conn, _, err := dialSSH(ctx, host, port, user, privKeyPath, knownHostsPath, strictHostKeyChecking)
+	conn, _, _, err := dialSSH(ctx, host, port, user, privKeyPath, knownHostsPath, strictHostKeyChecking)
 	if err != nil {
 		return &ShutdownResult{Success: false, Error: err.Error()}, nil
 	}

internal/sshmanager/testconn.go

@@ -22,26 +22,28 @@ type ConnResult struct {
 	Fingerprint string
 }
 
-func dialSSH(ctx context.Context, host string, port int, user, privKeyPath, knownHostsPath string, strictHostKeyChecking bool) (*ssh.Client, string, error) {
+func dialSSH(ctx context.Context, host string, port int, user, privKeyPath, knownHostsPath string, strictHostKeyChecking bool) (*ssh.Client, string, ssh.PublicKey, error) {
 	addr := fmt.Sprintf("%s:%d", host, port)
 
 	auths := []ssh.AuthMethod{}
 	if privKeyPath != "" {
 		key, err := os.ReadFile(privKeyPath)
 		if err != nil {
-			return nil, "", fmt.Errorf("reading private key: %w", err)
+			return nil, "", nil, fmt.Errorf("reading private key: %w", err)
 		}
 		signer, err := ssh.ParsePrivateKey(key)
 		if err != nil {
-			return nil, "", fmt.Errorf("parsing private key: %w", err)
+			return nil, "", nil, fmt.Errorf("parsing private key: %w", err)
 		}
 		auths = append(auths, ssh.PublicKeys(signer))
 	}
 
 	var capturedFingerprint string
+	var capturedPubKey ssh.PublicKey
 	hostKeyCallback := func(hostname string, remote net.Addr, key ssh.PublicKey) error {
 		h := sha256.Sum256(key.Marshal())
 		capturedFingerprint = "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:])
+		capturedPubKey = key
 		if strictHostKeyChecking && knownHostsPath != "" {
 			kh, err := GetKnownHost(filepath.Dir(knownHostsPath), host, port)
 			if err != nil {
@@ -71,15 +73,15 @@ func dialSSH(ctx context.Context, host string, port int, user, privKeyPath, know
 	conn, err := ssh.Dial("tcp", addr, cfg)
 	if err != nil {
 		if strings.Contains(err.Error(), "known_hosts") || strings.Contains(err.Error(), "host key") {
-			return nil, capturedFingerprint, fmt.Errorf("host key verification failed: %v", err)
+			return nil, capturedFingerprint, capturedPubKey, fmt.Errorf("host key verification failed: %v", err)
 		}
-		return nil, capturedFingerprint, fmt.Errorf("connection failed: %v", err)
+		return nil, capturedFingerprint, capturedPubKey, fmt.Errorf("connection failed: %v", err)
 	}
-	return conn, capturedFingerprint, nil
+	return conn, capturedFingerprint, capturedPubKey, nil
 }
 
 func TestSSHConnection(ctx context.Context, host string, port int, user, privKeyPath, knownHostsPath string, strictHostKeyChecking bool) (*ConnResult, error) {
-	conn, fingerprint, err := dialSSH(ctx, host, port, user, privKeyPath, knownHostsPath, strictHostKeyChecking)
+	conn, fingerprint, _, err := dialSSH(ctx, host, port, user, privKeyPath, knownHostsPath, strictHostKeyChecking)
 	if err != nil {
 		return &ConnResult{
 			Success:     false,
@@ -113,3 +115,7 @@ func TestSSHConnection(ctx context.Context, host string, port int, user, privKey
 		Fingerprint: fingerprint,
 	}, nil
 }
+
+func ConnectForApproval(ctx context.Context, host string, port int, user, privKeyPath, knownHostsPath string) (*ssh.Client, string, ssh.PublicKey, error) {
+	return dialSSH(ctx, host, port, user, privKeyPath, knownHostsPath, false)
+}