Add keyless (none) SSH authentication for Tailscale/WireGuard hosts

[borisevstratov]

Addresses #57

Used Claude Code for this one. Basically it just added a new auth strategy, so should be OK.
@h3nock could you please verify the code, and build. Thanks!

Summary

• Adds a third SSHAuthenticationKind, .none, alongside password and private key, so servers reachable only through an already-authenticated tunnel (Tailscale, WireGuard) no longer require a password or private key.
• Threads .none uniformly through the existing domain model, validator, Keychain-backed SSHCredentialStore, SSHAuthResolver, and RemuxRootModel's identity/credential save paths, mirroring the existing password/private-key code paths rather than special-casing credential lookup.
• Adds a NoneSSHAuthenticationDelegate in SSHAuthenticationMethodFactory that offers SSH's none auth method once via Citadel's SSHAuthenticationMethod.custom(_:) hook. No changes needed to the Citadel/swift-nio-ssh forks — NIOSSHUserAuthenticationOffer.Offer.none is already supported end-to-end there.
• Adds a "None" option to the connection form's authentication picker with an explanatory footnote, and updates docs/architecture.md.

Fixes #57

Test plan

• CI (.github/workflows/ci.yml) build + test pass on a macOS runner with full Xcode — could not run xcodebuild/tests locally in the environment this PR was authored in (Command Line Tools only, no Xcode.app).
• Added unit tests mirroring existing password/private-key coverage: SSHAuthResolverTests, TmuxConnectionDraftValidatorTests, RemuxRootModelTests (new-server save + direct connect), and a Keychain SSHCredential Codable round-trip test.
• Manual: create a new server in the app, choose "None" as the auth method, and connect to a host that accepts SSH's none auth (e.g. reachable only via a Tailscale/WireGuard tunnel with sshd configured to allow it).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 61d7fbc4-6f04-4ac3-a16b-01209f640be9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[borisevstratov]

@h3nock

fixed the failing tests in 2157f84

also, when you ssh via tailscale, it may show up a popup with browser confirmation, idk how remux would handle that scenario.

[borisevstratov]

@h3nock

I also played a bit with Moshi

they have pretty neat UX for keyless setup, but their sloppy UI is unbearable :-)
Maybe you can incorporate the similar UI flow, rather than adding another separate button for "None".

[h3nock]

@borisevstratov this is really neat. thanks for putting this together. somehow i missed the prev notification here.

the Moshi flow is a great reference too. i'm on it.

[borisevstratov]

@borisevstratov this is really neat. thanks for putting this together. somehow i missed the prev notification here.

the Moshi flow is a great reference too. i'm on it.

But your taste and minimal aesthetics are way beyond moshi!

[h3nock]

But your taste and minimal aesthetics are way beyond moshi!

haha thanks, really appreciate that!