Implement SSH proxy infrastructure for container access

## Motivation

Backend.AI needs secure, proxied access to compute session containers for features like `kubectl exec` and `kubectl attach`. Current approaches (krunner PTY, container SSH) require specific software inside the container image.

An SSH proxy infrastructure would:

- Work with any container image
- Maintain Backend.AI's security model (auth, authorization, audit)
- Provide a foundation for exec, attach, and similar features

## Required Features

1. **Agent SSH Proxy Server**
- SSH server on each Agent node
- PTY and non-PTY session support
- Terminal resize and SFTP support
1. **Container Backend Adapters**
- Docker: Wrapper around Docker Engine API
- Kubernetes: Expose existing `pod_exec` capability (currently internal-only)
1. **Manager Streaming API**
- Authenticated streaming endpoint for container I/O
- Session ownership validation
1. **App Proxy Integration**
- Register SSH proxy as session service port
- Route via existing TCP backend

## Impact

- **Agent**: High - SSH proxy server, backend adapters
- **Manager**: Medium - Streaming API endpoint
- **App Proxy**: Low - No changes needed

## Testing Scenarios

- PTY features (resize, signals, binary data)
- Auth: SSH keys, session tokens, ownership validation
- Docker and Kubernetes backend compatibility
- SFTP file operations
- Concurrent sessions, reconnection handling
- Security: rejection logging, rate limiting, audit

JIRA Issue: BA-3866