fix: show passphrase dialog for newly added SSH hosts

[dev01lay2]

Problem

When adding a second VPS (e.g. ssh:hetzner-2), the passphrase dialog was not shown. Instead the error immediately displayed:

SSH authentication failed (host: ssh:hetzner-2). Passphrase was submitted, but the remote host still rejected it.

No passphrase was ever actually submitted or prompted for.

Root Cause

In connectWithPassphraseFallback (App.tsx), the guard was:

if (host && host.authMethod !== "password" && SSH_PASSPHRASE_RETRY_HINT.test(raw))

When InstallHub.tsx adds a new host, it calls upsertSshHost() then immediately connectRemoteHost(saved.id). But the React sshHosts state hasn't re-rendered yet, so sshHosts.find(h => h.id === hostId) returns undefined.

With host being undefined, the guard short-circuits to false, the passphrase dialog is skipped, and the code falls through to buildSshPassphraseConnectErrorMessage which shows the misleading "Passphrase was submitted" message.

Not a passphrase caching issue — each connection in SshConnectionPool stores its passphrase independently by host ID and never reuses another host's passphrase.

Fix

1. Guard fix: Change host && to (!host || ...) so the passphrase dialog is shown even when the host isn't in React state yet (assume non-password auth for unknown hosts)
2. Error message fix: Add passphraseWasSubmitted flag to buildSshPassphraseConnectErrorMessage to distinguish:
   • Passphrase was entered but still rejected → ssh.publicKeyRejected (existing)
   • No passphrase was ever entered → ssh.publicKeyAuthFailed (new, no misleading text)
3. Locale: Added ssh.publicKeyAuthFailed in both en.json and zh.json
4. Tests: Updated to cover both paths

Files Changed

• src/App.tsx — guard fix + pass flag to error builder
• src/lib/sshConnectErrors.ts — add optional passphraseWasSubmitted param
• src/locales/en.json / src/locales/zh.json — new locale key
• src/lib/__tests__/sshConnectErrors.test.ts — test both paths

[Keith-CY]

LGTM — fix is sound. It correctly handles transient missing state when adding a new SSH host and improves SSH failure messaging with an explicit no-passphrase path. No blocking issues found.

[Keith-CY]

LGTM — fix is sound. It correctly handles transient missing sshHosts state when adding a new SSH host and improves SSH failure messaging with an explicit no-passphrase path. No blocking issues found.