fix: SSH-tunneled connections failing to reconnect after idle/sleep

[datlechin]

Summary

Fixes #736 — SSH-tunneled connections through AWS EC2 show password/authentication errors after being idle for days.

Root causes identified and fixed:

• Health monitor never rebuilt SSH tunnels — reconnectDriver reused a stale effectiveConnection pointing at 127.0.0.1:<dead_port>. Now calls buildEffectiveConnection for SSH sessions to create a fresh tunnel.
• No OS-level TCP keepalive — SSH sockets had no SO_KEEPALIVE, so AWS NAT gateway idle timeouts (350s) silently dropped connections. Added SO_KEEPALIVE + TCP_KEEPALIVE (60s idle).
• No sleep/wake handling — Added NSWorkspace.didWakeNotification observer to proactively validate SSH tunnels on wake instead of waiting for the 30s health monitor ping.
• App Nap throttled keepalives — Added ProcessInfo.beginActivity(.userInitiatedAllowingIdleSystemSleep) while tunnels are active.
• Nil SSH password silently coerced to empty string — Keychain lookup failures produced a generic "authentication failed" error. Now throws a descriptive error and extracts libssh2_session_last_error detail in PasswordAuthenticator and KeyboardInteractiveAuthenticator.
• 5-retry cap too low — Increased to 10 retries with 120s max backoff (~10 min total window).
• No reentrancy guard — Both keepalive death and wake handler could fire handleSSHTunnelDied concurrently. Added recoveringConnectionIds: Set<UUID> guard.
• Tunnel leak on driver connect failure — If buildEffectiveConnection succeeded but driver.connect() failed, the tunnel was orphaned. Added cleanup.

Changes

File	Change
DatabaseManager+Health.swift	reconnectDriver rebuilds SSH tunnel; returns ReconnectResult with driver + effectiveConnection; cleans up tunnel on driver failure
DatabaseManager+SSH.swift	Reentrancy guard via recoveringConnectionIds; 10 retries / 120s max; disconnect live driver not stale snapshot
DatabaseManager.swift	Added recoveringConnectionIds: Set<UUID>
DatabaseManager+SystemEvents.swift	New — didWakeNotification → validates SSH tunnels on wake
AppDelegate.swift	Wires up startObservingSystemEvents()
SSHTunnelManager.swift	App Nap prevention via ProcessInfo.beginActivity
LibSSH2TunnelFactory.swift	SO_KEEPALIVE + TCP_KEEPALIVE on SSH sockets; nil password guard
PasswordAuthenticator.swift	Extracts libssh2 error detail on failure
KeyboardInteractiveAuthenticator.swift	Extracts libssh2 error detail on failure
CHANGELOG.md	Added entry under [Unreleased]

Test plan

• Connect to a remote database via SSH tunnel (password auth) — verify connection works
• Leave the connection idle for several minutes, then interact — verify auto-reconnect succeeds
• Put Mac to sleep with an active SSH tunnel, wake up — verify tunnel recovers automatically
• Test with an incorrect SSH password in Keychain — verify descriptive error message appears
• Test with two SSH-tunneled connections, kill one tunnel — verify the other is unaffected
• Verify local (non-SSH) connections are unaffected by all changes