Add stored SSH key replacement

[bifrost0x]

Summary

Adds a safe way to replace the private key material behind an existing stored SSH key without changing its stable key ID.

• Adds a Replace action to SSH key management
• Preserves profile and jump-host references
• Requires the replacement to use the same actual key type
• Rejects inconsistent legacy key metadata before writing
• Atomically replaces encrypted key data and restores the previous ciphertext if writing or verification fails
• Adds audit events without logging private key content
• Warns operators to install the matching public key on all targets first
• Keeps active sessions connected while future connections use the replacement key

Why

Deleting and re-uploading a key breaks every saved profile and jump host that references its ID. Replacing only the encrypted key material keeps those references intact and makes routine key rotation practical.

Related discussion: #59

Validation

• 1,468 Python tests passed
• 155 JavaScript tests passed
• 16 relevant Playwright tests passed
• ESLint passed
• Vendored frontend assets verified
• Independent code review completed