SSH2FA 1.6.0 — Linux support, optional 2FA

SSH2FA now runs on Linux, and a host no longer needs 2FA to be added.

Accounts without 2FA

Leave the 2FA field empty when adding a host and it is registered as
password-only — it logs in normally, because the server never asks for a code.
Previously an empty secret was rejected as an invalid otpauth:// URL, so such
an account could not be added at all.

A secret can be added later, or removed, from Password & setup. A typo'd
secret is still refused at entry: blank means "no 2FA", it does not mean
"accept anything".

Linux

The daemon, CLI and TUI now run on Linux. The menu-bar app is macOS-only, so on
Linux the dashboard is ssh2fa (the TUI). Everything else is shared code — the
same warm ControlMasters, the same 2FA handling, the same tunnels and mounts.

git clone https://github.com/gasvn/ssh2fa && cd ssh2fa/auto2fa-rs
./scripts/install-linux.sh                # desktop (keyring)
./scripts/install-linux.sh --vault file   # headless server

No root, nothing system-wide: binaries in ~/.local/bin plus a systemd user
service. Credentials go to the freedesktop Secret Service, or to an owner-only
0600 file on a headless box where no keyring exists. See
docs/LINUX.md.

The TUI can manage, not just drive

Press Enter on a host for its details: what is stored, the live 2FA code
(c), a real test login (t), and removal (D). Press e on a tunnel to
edit its ports, auto-start and name. Previously anything beyond connect/start
had to go through ssh2fa raw.

Fixes

• The daemon could be starved by launchd and never start. Its LaunchAgent
  set ProcessType=Background, putting it in a low-priority scheduling band; on
  a loaded machine launchd created the process stub and never scheduled it far
  enough to exec, leaving every host stuck on "Reconnecting". It presents as a
  code-signing failure and is not one.
• A broken pipe crashed the CLI. ssh2fa … | head printed a Rust panic
  instead of exiting quietly like any other Unix tool.
• Mounting could not work on Linux at all — the service's own hardening blocked
  the setuid fusermount3 that unprivileged FUSE mounts require. A failed mount
  also now reports why instead of a bare failure.
• Unmounting no longer requires sshfs to be installed; you could previously be
  left with a mount you had no way to remove.

Naming

The CLI and TUI are now ssh2fa and ssh2fa-tui, matching the app and the
daemon. ssh2fa with no arguments opens the dashboard.