feat: add CA-signed certificate authentication for SSH credentials

Support OpenSSH certificate-based authentication (-cert.pub files) in
the Credentials manager. When a CA-signed certificate is stored alongside
a private key, Termix uses it during SSH connection establishment so that
servers relying on certificate-based authorization work out of the box.

Changes:
- db/schema.ts: add cert_public_key column to ssh_credentials table
- db/index.ts: auto-migration via addColumnIfNotExists
- routes/credentials.ts: expose certPublicKey in create/update/get endpoints
- ssh/auth-manager.ts: include certPublicKey in ResolvedCredentials
- ssh/host-resolver.ts: propagate certPublicKey when resolving credentials
- ssh/opkssh-cert-auth.ts: refactor shared logic into _applyCertToConnection;
  export new setupCACertAuth() with optional passphrase support
- ssh/terminal.ts: call setupCACertAuth() when a certificate is present
- utils/ssh-key-utils.ts: detect all OpenSSH cert types in public key parser
- types/index.ts: add certPublicKey to Credential, CredentialBackend,
  CredentialData interfaces
- CredentialAuthenticationTab.tsx: new CA Certificate section with file
  upload, paste editor and automatic cert-type badge
- CredentialEditor.tsx: certPublicKey wired into form schema and submit
- CredentialViewer.tsx: show certificate status in security tab
- locales/en.json: add i18n strings for new UI elements

src/ui/locales/en.json

@@ -10,7 +10,17 @@
     "sshKey": "SSH Key",
     "uploadPrivateKeyFile": "Upload Private Key File",
     "searchCredentials": "Search credentials...",
-    "addCredential": "Add Credential"
+    "addCredential": "Add Credential",
+    "caCertificate": "CA Certificate (-cert.pub)",
+    "caCertificateDescription": "Optional: Upload or paste the CA-signed certificate file (e.g. id_ed25519-cert.pub). Required when your SSH server uses certificate-based authorization.",
+    "uploadCertFile": "Upload -cert.pub File",
+    "clearCert": "Clear",
+    "certLoaded": "Certificate loaded",
+    "certPublicKeyLabel": "CA Certificate",
+    "certTypeLabel": "Certificate type",
+    "pasteOrUploadCert": "Paste or upload a -cert.pub certificate...",
+    "hasCaCert": "Has CA Certificate",
+    "noCaCert": "No CA Certificate"
   },
   "homepage": {
     "failedToLoadAlerts": "Failed to load alerts",