sync: sftp and b2 credential keys don't match rclone's option schema

[mbertschler]

Problem (friction log F5, S1 — confirmed live)

RcloneSection renders squirrel's TOML key names verbatim into rclone.conf, but two backends use names rclone doesn't recognise:

• sftp: squirrel writes password = <plaintext>; rclone's sftp backend only knows pass, and requires it rclone-obscured. rclone ignores the unknown key and falls back to ssh-agent — observed as couldn't connect to ssh-agent: SSH agent requested but SSH_AUTH_SOCK not-specified. Password-auth sftp destinations have therefore never worked against real rclone (unit tests fake rclone; CI's integration test covers the S3 reader only). key_file auth works, which is why this stayed hidden.
• b2 (suspected, unverified — no b2 endpoint in the testbed): squirrel writes account_id / application_key; rclone wants account / key.

s3 and gcs key names happen to match rclone's.

Plan

• Render sftp pass with the value obscured at render time (squirrel already holds the plaintext from config/env, so the config surface doesn't change; rclone's obscure algorithm is a fixed published AES key, implementable in Go without shelling out).
• Map b2 to account / key (verify against rclone's b2 docs while in there; sweep all schemas).
• Add a test that pins every destination schema's rendered keys against rclone's real option names, so the next backend addition can't repeat this class of bug.

Acceptance

• A password-auth sftp destination transfers successfully against a real rclone serve sftp (the testbed in design/testbed.md reproduces this in minutes).
• Rendered-key pinning test in place for all rclone-backed types.

Found by the reference-setup walk — see design/friction-log.md F5 for the full diagnosis.