SSH tunnels (x/crypto/ssh)

Per-source tunnel config: host-key verification, agent auth, keepalives/reconnect. Until this ships, dsn_cmd + user-side `ssh -L` covers remote access.

**Acceptance:** tunnel source connects through a bastion in the integration suite; host-key mismatch is a hard error.

Locate the per-source configuration and integration suite, then trace how dsn_cmd establishes remote connections through a bastion. Verify the tunnel supports host-key verification, agent authentication, keepalives, and reconnects; done means the integration suite passes and a host-key mismatch is a hard error.

Written by the indexing model from the issue text.