feat: Step CA SSH certificates as a host authentication type (#1340)

* feat: Step CA SSH certificates as a host authentication type

Issue short-lived SSH user certificates from a smallstep CA through its
OIDC provisioner, over the CA's HTTP API rather than the step binary.
Everything after issuance reuses the OPKSSH plumbing: the same encrypted
per-user/host token store, WebSocket dialog and ssh2 certificate
injection, with the connect paths branching on a shared
usesIssuedCertificate() predicate. Instance-wide CA settings live in the
admin panel, with a private-host allowlist for the SSRF guard.

* fix: harden Step CA callback flow

* style: format Step CA changes

src/backend/hosts/metrics/helpers.ts

@@ -1,4 +1,5 @@
 import type { Client } from "ssh2";
+import { usesIssuedCertificate } from "../issued-certificate-auth.js";
 
 export type StatsCapableHost = {
   connectionType?: string;
@@ -13,7 +14,8 @@ export type TcpPingStatsConfig = {
 export function supportsMetrics(host: StatsCapableHost): boolean {
   const connectionType = host.connectionType || "ssh";
   if (connectionType !== "ssh") return false;
-  if (host.authType === "none" || host.authType === "opkssh") return false;
+  if (host.authType === "none" || usesIssuedCertificate(host.authType))
+    return false;
   return true;
 }