feat: move opkssh and warpgate into plugins (C3)

plugins/opkssh/README.md

@@ -0,0 +1,34 @@
+# OPKSSH
+
+Adds the `opkssh` SSH auth type: Termix signs you in with your identity
+provider in the browser, gets a short-lived SSH certificate from
+[OpenPubkey SSH](https://github.com/openpubkey/opkssh), and caches it for 24
+hours.
+
+## Config
+
+`<DATA_DIR>/plugins/opkssh/config.yml`, OPKSSH's own config format. A
+template is written there the first time someone signs in without one. An
+install upgraded from 2.8 has its old `<DATA_DIR>/.opk/config.yml` copied
+here.
+
+`redirect_uris` in that file are OPKSSH's local listener on the Termix
+server and must be localhost (or left out). The public callback is passed
+to OPKSSH as `--remote-redirect-uri`; register it with your identity
+provider. The plugin's admin settings page shows it:
+`<base URL>/plugin-api/opkssh/callback`, or `<base URL>/host/opkssh-callback`
+while "Use the old redirect URI" is on.
+
+## Binary
+
+The plugin runs `opkssh` pinned to one release and its SHA-256. It looks, in
+order, at:
+
+1. `OPKSSH_BUNDLED_DIR/<asset>` (default `<cwd>/opkssh-bundled`). The Docker
+   image bakes the binary into `/app/opkssh-bundled`, so offline installs
+   never download it.
+2. `<DATA_DIR>/plugins/opkssh/bin/<asset>`, a copy downloaded earlier.
+3. A download from the GitHub release.
+
+Any copy whose checksum does not match is ignored. `OPKSSH_VERSION` picks
+another release; `OPKSSH_SHA256` must then give its checksum.