Add SSH config alias onboarding for ssync hosts

[Ramlaoui]

Motivation

Many users already maintain cluster access in ~/.ssh/config using aliases such as ruche, adastra, or my-lab-cluster. In those cases, ssync should not require users to duplicate SSH details such as HostName, User, IdentityFile, ProxyJump, or port settings in its own config.yaml.

What ssync still needs are ssync-specific fields: remote work directory, scratch directory, and optional Slurm defaults. It would be useful to provide a first-class onboarding path that imports or references an existing SSH config alias and writes a valid ssync host entry around it.

Proposed behavior

Add a library/API path for creating an ssync host from an existing SSH config alias.

Example desired output:

hosts:
  - hostname: ruche
    use_ssh_config: true
    work_dir: /gpfs/work/$USER/project
    scratch_dir: /gpfs/scratch/$USER
    slurm_defaults:
      partition: gpu
      time: "02:00:00"

The default behavior should keep SSH configuration in ~/.ssh/config and only store the alias in ssync config. It should not copy private SSH details into config.yaml unless an explicit expanded/static export mode is added later.

Possible API shape

list_ssh_config_aliases() -> list[SshAlias]
resolve_ssh_config_alias(alias: str) -> ResolvedSshAlias
add_host_from_ssh_alias(
    alias: str,
    work_dir: str,
    scratch_dir: str,
    slurm_defaults: dict | None = None,
    config_path: Path | None = None,
) -> ConfigEditResult

Optional web/CLI surface:

GET  /api/config/ssh-aliases
GET  /api/config/ssh-aliases/{alias}
POST /api/config/hosts/from-ssh-alias
POST /api/config/hosts/{host}/test

Safety and implementation notes

• Prefer resolving aliases through OpenSSH-compatible behavior, for example ssh -G <alias>, rather than hand-parsing every SSH config edge case.
• Avoid returning or persisting secrets from SSH config.
• Validate the resulting ssync config using the existing config loader before committing it.
• Write atomically and avoid corrupting an existing user config.
• Support a dry-run/preview mode so callers can show the resulting YAML/diff before saving.
• Use an mtime/hash guard to avoid overwriting concurrent manual edits.
• Default to editing the user config path only; repo-local config editing should require an explicit path/opt-in.
• Preserve unrelated existing config fields where possible.

Why this belongs in ssync

This keeps config semantics, validation, host identity, and security boundaries inside ssync instead of forcing each CLI/web/UI integration to implement its own YAML mutation logic. It also matches the existing runtime behavior where hosts can already use SSH config aliases with use_ssh_config: true.