feat: add auth extension points and one ssh connect pipeline

src/backend/hosts/file-manager/ca-cert-auth.ts

@@ -1,51 +0,0 @@
-import { getErrorMessage } from "../../utils/error-message.js";
-import type { Client as SSHClient, ConnectConfig } from "ssh2";
-import { fileLogger } from "../../utils/logger.js";
-
-/**
- * Attaches a user-managed CA-signed certificate to an SFTP connection, if the
- * host carries one.
- *
- * The terminal has always done this. The file manager never did: it imports
- * and calls `setupOPKSSHCertAuth`, but `setupCACertAuth` — the sibling helper
- * for user-managed `-cert.pub` files — had no call site here at all. A host
- * whose key is paired with a CA-signed certificate therefore authenticated in
- * a terminal and failed in the file manager, while OPKSSH certificates worked
- * in both. That asymmetry is the whole bug.
- *
- * `cert_public_key` is a column on `ssh_data` but is not part of the shared
- * `Host` type, so callers pass whichever record they hold and it is read off
- * structurally — the same way the terminal reads it.
- *
- * A certificate that cannot be applied is logged and skipped rather than
- * failing the connection: the private key alone may still be accepted, which
- * is exactly what happened before any of this was wired up.
- */
-export async function applyCACertIfPresent(
-  config: Record<string, unknown>,
-  client: SSHClient,
-  privateKey: Buffer | string,
-  source: { certPublicKey?: string | null },
-  username: string,
-  passphrase?: string,
-): Promise<void> {
-  const certPublicKey = source.certPublicKey;
-  if (!certPublicKey || !certPublicKey.trim()) return;
-
-  try {
-    const { setupCACertAuth } = await import("../opkssh-cert-auth.js");
-    await setupCACertAuth(
-      config as ConnectConfig,
-      client,
-      privateKey,
-      certPublicKey,
-      username,
-      passphrase,
-    );
-  } catch (certError) {
-    fileLogger.warn("CA certificate setup failed, continuing with key only", {
-      operation: "sftp_ca_cert_auth_failed",
-      error: getErrorMessage(certError),
-    });
-  }
-}