Fix SSH public key format: use ssh.MarshalAuthorizedKey

Bug: raw ed25519.PublicKey bytes were stored directly instead of
OpenSSH authorized-key format (ssh-ed25519 AAAA... label).

Fixes:
- internal/sshmanager/fingerprint.go: GenerateKeyPair now uses
  ssh.NewPublicKey + ssh.MarshalAuthorizedKey
- internal/sshmanager/keys.go: EnsureServerKey uses same fix; also
  regenerates .pub file from private key if stored value is corrupt
- internal/sshmanager/fingerprint.go: add MarshalED25519PublicKey,
  PublicKeyFromPrivateKeyFile, RegeneratePublicKeyFromPrivateKeyFile
- internal/models/sshkey.go: add UpdatePublicKey
- internal/api/handlers_sshkeys.go: List+Get recover existing DB
  records with corrupt public keys by regenerating from private key
  file and updating the DB

Also adds golang.org/x/crypto/ssh dependency via go mod tidy.

internal/models/sshkey.go

@@ -68,6 +68,11 @@ func (r *SSHKeyRepository) Delete(id int64) error {
 	return err
 }
 
+func (r *SSHKeyRepository) UpdatePublicKey(id int64, pubKey string) error {
+	_, err := r.db.Exec("UPDATE ssh_keys SET public_key = ? WHERE id = ?", pubKey, id)
+	return err
+}
+
 func (r *SSHKeyRepository) GetServerKey() (*SSHKey, error) {
 	var k SSHKey
 	err := r.db.QueryRow(