fix(ssh): openTunnel leaks sockets on its failure paths, ignores a missing key file, and dials twice for concurrent callers #1312

Problem

lib/core/security/ssh_tunnel_manager.dart, openTunnel:

1. Leaks. If the jump host login (await jumpClient.authenticated), forwardLocal, the key parse (SSHKeyPair.fromPem), the host key check or ServerSocket.bind fails, the jump client and the open bastion socket are not closed (testSshConnection does close in finally).
2. Missing key file. For key authentication with privateKeyPath, file.exists() false falls through with no identities and the client tries the password ''; the user gets SSH authentication failed instead of key file not found.
3. Concurrent dial. Two callers with the same pool key (tree load: read-only and read-write sessions) both see no session and both dial and log in; the second overwrites _sessions[poolKey]. Not a leak (the first is closed when its handle is released) but two SSH logins per start, which can trip fail2ban-style limits.

Scope

• Close every opened client / socket on failure (a try/finally around the setup).
• Fail clearly when the key file is missing or empty.
• Single-flight per pool key (a pending-future map).
• Tests with the existing fake connector: count open sockets after each failure; two concurrent opens dial once.

Acceptance

• After any failed openTunnel no client or socket stays open.
• A missing key file reports the path.
• Two concurrent openTunnel calls for one target dial once and share the session.