feat: add multi-jump SSH support via ProxyJump

[datlechin]

Summary

• Add multi-hop SSH tunneling using OpenSSH's -J (ProxyJump) flag, allowing connections through chains of bastion hosts (e.g., Local → Bastion1 → Bastion2 → DB Server)
• Jump hosts support Private Key and SSH Agent auth (not password — -J doesn't support ASKPASS for intermediate hops)
• Parse ProxyJump directives from ~/.ssh/config and auto-fill jump hosts when selecting a config entry

Changes

File	Change
DatabaseConnection.swift	SSHJumpAuthMethod enum, SSHJumpHost struct, jumpHosts on SSHConfiguration, backward-compatible Codable
SSHTunnelManager.swift	jumpHosts param on createTunnel(), builds -J and -i flags
SSHConfigParser.swift	Parse ProxyJump directive, parseProxyJump() helper
DatabaseManager.swift	Pass jumpHosts to createTunnel()
ConnectionFormView.swift	Jump Hosts UI section (add/remove/reorder, auth picker, key browse)
SSHJumpHostTests.swift	New — 9 model/validation/Codable tests
SSHConfigurationTests.swift	3 new tests (jump host validation, backward-compat decoding)
SSHConfigParserTests.swift	8 new tests (ProxyJump parsing)
CHANGELOG.md	Added entry
docs/ + docs/vi/	Multi-Jump SSH documentation section

Backward Compatibility

• SSHConfiguration custom decoder uses decodeIfPresent — old JSON without jumpHosts decodes to []
• createTunnel() new parameter defaults to [] — existing call sites unchanged
• No Keychain changes — jump hosts don't store passwords

Test plan

• Build succeeds (xcodebuild build)
• All SSH tests pass (SSHJumpHostTests, SSHConfigurationTests, SSHConfigParserTests)
• Lint clean (swiftlint lint --strict — 0 violations)
• Manual: Open app → New Connection → SSH tab → Enable SSH → verify Jump Hosts section appears with add/remove/reorder

Closes #200

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.