Manage the BMC's SSH keys and change its password from the interface and the fleet

[excavador]

The problem

The only way to put an SSH key on the BMC, or take one off, is to log in over SSH and edit /root/.ssh/authorized_keys by hand. That is fine for one board and the first key. It is not fine for the second board, the second person, or the day a key has to be revoked in a hurry: the file lives on the overlay, so it survives every firmware flash, and nothing in the interface even shows what is in it.

The idea

• See the keys the board trusts for root: type, fingerprint, comment, and any from= restriction, on the Settings tab and in the API (GET /api/bmc/ssh/keys).
• Add a public key by pasting it; the board validates it before writing (a bad line locks nobody out, it is simply refused).
• Remove a key by fingerprint, with the usual confirmation.
• The same across every board at once from the fleet page: add your key to eight boards in one action, revoke it from eight in one action.
• tpi ssh-keys list|add|remove for scripts.

And the password

The interface asks for root's password on every login and has no way to change it; that takes a shell on the board. So:

• Change the password from Settings: current password plus the new one, refused without the current one so a left-open session cannot lock its owner out.
• Say plainly which password it is: the board's own account, used by the interface and by SSH password login. Changing one changes both.
• From the fleet, on every board at once, with a per-board result, because a partial failure is exactly what the next login will find.
• tpi password for scripts, reading the value from a prompt or a file, never from the command line.

Care

• The password is written the way the system writes it (chpasswd), never by editing /etc/shadow by hand; the change is an audit line that says that it changed, never the value.
• Never write a file the board cannot parse; validate with the same parser sshd uses, and keep permissions at 0600.
• Refuse to remove the last key while password login is disabled, so the operation cannot strand the board.
• Every change is an audit line (see the syslog + audit idea).

Why it matters

An overlay-resident key outlives every flash. The interface should show it and be able to take it back.

Upvote if you want this; comment if you would shape it differently.