Add multi-server connection management

[powerfooI]

Summary

• add a server-side connection manager with independently isolated local and SSH Herdr runtimes
• persist strict local/SSH profiles and expose connection CRUD, testing, default selection, connect, and disconnect operations
• bind RPC, HTTP, terminal, clipboard, file, Git, worktree, agent, settings, and frontend state to connection IDs and runtime generations
• add the connection selector/manager UI with per-browser active selection and connection-scoped persistence
• supervise SSH tunnels with validated OpenSSH destinations, private local sockets, functional probes, bounded cleanup, and cancellable retry
• harden WebSocket origin/hello handling and downstream NDJSON envelope bounds
• restore full-page Page Up/Page Down behavior in fullscreen Pi while preserving Alt/Option half-page scrolling

Screenshot

Security and compatibility

• SSH profiles contain no passwords, keys, passphrases, ports, commands, or arbitrary options; transport customization remains in OpenSSH config
• normal host-key verification stays enabled and validated destinations are placed after --
• the private profile registry uses bounded strict schemas, atomic writes, mode 0700 directories, mode 0600 files, and symlink rejection
• explicit CLI/environment connections remain a read-only legacy process default
• missing connection identity/generation remains a bounded old-client compatibility path; malformed, stale, unknown, and not-ready identities fail deterministically

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• TMPDIR=/tmp bun run test — 542 passed, 1 opt-in skipped, 0 failed across 81 files
• cd web && bun run build — 2087 modules transformed
• production local-profile and fake-SSH process fixtures
• opt-in real OpenSSH control/render socket smoke — 1 passed, 0 failed
• standalone bridge smoke with local and SSH profiles, scoped workspace listing, and terminal render attachment
• multiple independent adversarial review rounds with final focused re-reviews passing
• git diff --check; no generated build output or credential material committed

Follow-ups / manual coverage

• the selector is keyboard accessible, but this PR does not add a global next/previous-connection shortcut
• a full mobile, screen-reader, zoom/safe-area, and fullscreen visual matrix remains manual follow-up
• aggregate resource limits and broader operational policy remain planned M7 hardening