v3.8.7

Security release — two advisories fixed. Upgrade: npm install -g mcp-ssh-manager@3.8.7

Advisory	Severity	What it was
GHSA-mq9f-5385-rjf4	high	A partial server name, an alias the agent created itself, or the host escaped readonly and restricted mode: the policy looked the server up by its exact name while the connection resolved the rest. Reported by @nikhilagrawalsf.
GHSA-2wjh-xm9c-7qf9	high	ssh_backup_restore's backupId reached the server inside cat "…", where $(…) still runs; ssh_backup_create's mkdir -p "…" had the same flaw with backupDir. Reported by @NYBaywatch.

Also: per-server OpenSSH user certificates (CERTPATH / cert_path, #93, thanks @majordave), effective once ssh2 ships certificate support, and the dependency advisories published since 3.8.6 (zod, body-parser, fast-uri, ip-address). npm audit is clean.

Published from CI with npm provenance; the SBOM is attached and attested. Full details in the CHANGELOG.