Per-instance SSH key encryption (HKDF) with re-encrypt migration

Seventh hardening-chain link. Instance SSH private keys are all encrypted at rest under the single global SSH_ENCRYPTION_KEY, so a leaked ciphertext plus the master exposes every instance and there is no per-instance rotation.

Change

Keys are encrypted under a per-instance key: HKDF-SHA256(SSH_ENCRYPTION_KEY, info=instanceId). The master secret is unchanged — no new configuration; per-instance domain separation means a leaked ciphertext exposes only one instance. decrypt_private_key tries the derived key and falls back to the raw master, so pre-migration ciphertexts still decrypt (graceful, reversible). A one-time scripts/migrate_ssh_keys.py re-encrypts every stored key from master to derived inside one transaction, verifying each round-trips before writing, idempotent, with --dry-run.

Tests / rehearsal

Unit tests for derivation + fallback. Rehearsed on a seeded database: master-encrypted key decrypts via fallback pre-migration; migration re-encrypts (round-trip verified); decrypts under derived after; second run is a no-op.

Start by locating the existing decrypt_private_key flow and reviewing scripts/migrate_ssh_keys.py. Verify the derivation and fallback behavior, migration round trips, transaction safety, idempotence, and --dry-run behavior against the seeded-database rehearsal described in the issue.