feat(ssh-config): adopt matching connections instead of creating duplicates

[kipavy]

What & why

The SSH Config Sync plugin scopes its deduplication to connections it owns (those tagged ssh-config). A connection you created by hand — e.g. "Serv Oracle" — is untagged, so the plugin can't see it and creates a duplicate ("Oracle") when the same server appears in ~/.ssh/config. This adds an opt-out setting (on by default) that lets the plugin adopt a matching untagged connection instead of duplicating it.

Closes the duplicate-on-import behavior reported for hosts that already exist in Voltius under a different label.

Behavior

When a config host matches an existing untagged connection by host + port + username:

• The plugin reuses it instead of creating a duplicate.
• It's gentle: your label, auth type, identity, tags, and jump_hosts are preserved. Only host/port/username edits from the config propagate.
• Adopted connections are never auto-deleted — even if the alias later disappears from ~/.ssh/config.
• If several untagged connections match, the first wins (deterministic).

Design notes

• Adoption is derived from the tag, not persisted separately: plugin-created connections are tagged ssh-config; adopted ones are deliberately left untagged. So there's no new storage state, and "never delete" is structural — the removal pass only ever touches tagged connections.
• The setting gates only the untagged content-fallback search; the alias_map by-id lookup is unconditional, so already-adopted connections stay managed even if the setting is later turned off.
• The ProxyJump second pass is guarded so it never overwrites an adopted connection's jump_hosts.

New setting: Settings → SSH Config Sync → "Adopt matching connections" (on by default).

Tests

New sync.test.ts (stateful mock harness) — 14 tests covering: adoption match/no-duplicate, field preservation, first-match-wins, setting-off duplicate, never-delete, re-find on second sync (isolated from the content fallback), host/port propagation, ProxyJump-not-overwritten-on-adopted vs written-on-tagged, and adopted-host-with-IdentityFile skip. npx vitest run src/plugins/ssh-config/ → 14/14; tsc --noEmit clean.

Not yet verified

The new settings toggle has not been clicked in a running app — the headless UI environment was unavailable this session. The sync() adoption logic is fully unit-tested; the UI is a straightforward mirror of the existing Notifications toggle, but the render/persist behavior is unverified live.