feat(osc52): clipboard support (remote → local, per-host opt-in)

[thangnm93]

Summary

Adds OSC 52 clipboard support so remote apps (tmux, vim) can write the user's local system clipboard over SSH. Write-only and gated behind a per-host opt-in that defaults off. Closes #70.

Changes

• osc52_clipboard.dart — pure Osc52Clipboard.parse decoding the OSC 52 payload: rejects read queries (?), invalid base64, and payloads over a 1 MiB cap; UTF-8 decode is malformed-tolerant; fail-soft (never throws).
• Host.osc52Clipboard — per-host opt-in field (default false; toJson/fromJson/copyWith; rides existing sync).
• SshService.dispatchPrivateOsc — routes onPrivateOSC: code 52 (when the host toggle is on) writes via an injectable clipboardWriter (defaults to Clipboard.setData); codes 7/133 still go to shell integration. onPrivateOSC is now wired whenever shell integration or OSC 52 is enabled. No xterm core change.
• Host panel — "OSC 52 clipboard" toggle in the SSH section (hidden for RDP) with a short security note.

Type of change

• feat — new feature

How was this tested?

• cd app && flutter analyze — no new warnings (4 touched files clean)
• cd app && flutter test — 17 new tests (parser 7, model 4, dispatch 4, panel 2) + agent-forwarding regression + full test/models/ (187) pass
• Manually verified on: pending (needs a live SSH host: printf '\033]52;c;%s\007' "$(printf hi | base64)")

Security notes

• Write-only: OSC 52 read queries are ignored, so a remote can never read the local clipboard.
• Per-host opt-in, default off; 1 MiB cap; bad/oversized payloads dropped silently.

Checklist

• PR title follows Conventional Commits
• Code and comments are written in English
• New/changed behavior is covered by tests
• No secrets, credentials, or personal data in the diff