Fix SSH public key format: use ssh.MarshalAuthorizedKey

Bug: raw ed25519.PublicKey bytes were stored directly instead of
OpenSSH authorized-key format (ssh-ed25519 AAAA... label).

Fixes:
- internal/sshmanager/fingerprint.go: GenerateKeyPair now uses
  ssh.NewPublicKey + ssh.MarshalAuthorizedKey
- internal/sshmanager/keys.go: EnsureServerKey uses same fix; also
  regenerates .pub file from private key if stored value is corrupt
- internal/sshmanager/fingerprint.go: add MarshalED25519PublicKey,
  PublicKeyFromPrivateKeyFile, RegeneratePublicKeyFromPrivateKeyFile
- internal/models/sshkey.go: add UpdatePublicKey
- internal/api/handlers_sshkeys.go: List+Get recover existing DB
  records with corrupt public keys by regenerating from private key
  file and updating the DB

Also adds golang.org/x/crypto/ssh dependency via go mod tidy.

internal/api/handlers_sshkeys.go

@@ -51,6 +51,12 @@ func (h *SSHKeyHandler) List(w http.ResponseWriter, r *http.Request) {
 			hasPriv = true
 		}
 		fp, _ := sshmanager.Fingerprint(k.PublicKey)
+		if fp == "" && hasPriv {
+			pubKey, newFP, _ := sshmanager.RegeneratePublicKeyFromPrivateKeyFile(k.PrivateKeyPath, k.Label)
+			repo.UpdatePublicKey(k.ID, pubKey)
+			k.PublicKey = pubKey
+			fp = newFP
+		}
 		out[i] = SSHKeyResponse{
 			ID:            k.ID,
 			Label:         k.Label,
@@ -151,6 +157,12 @@ func (h *SSHKeyHandler) Get(w http.ResponseWriter, r *http.Request) {
 		hasPriv = true
 	}
 	fp, _ := sshmanager.Fingerprint(k.PublicKey)
+	if fp == "" && hasPriv {
+		pubKey, newFP, _ := sshmanager.RegeneratePublicKeyFromPrivateKeyFile(k.PrivateKeyPath, k.Label)
+		repo.UpdatePublicKey(k.ID, pubKey)
+		k.PublicKey = pubKey
+		fp = newFP
+	}
 	writeJSON(w, SSHKeyResponse{
 		ID:            k.ID,
 		Label:         k.Label,