[KubeKyrie]

Description

Read SSH public keys from the same rlark-ssh-keys Secret used by Gateway, regardless of database configuration. Match keys by username and preserve usernames containing hyphens. Add regression tests and update English and Chinese documentation.

Motivation and Context

Gateway stores registered keys in a Secret, but Server previously queried PostgreSQL when --db-config was enabled. This caused valid registered keys to fail authentication with Permission denied (publickey).

How has this been tested?

• Passed go test ./apps/rlark/pkg/server/....
• Covered username/key matching, key rotation and deletion, missing Secrets, and API errors.
• Passed git diff --check.

The full repository test suite was not run.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Documentation update
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

[KubeKyrie]

I have tested and it works.

[lkygithub]

Hi @KubeKyrie , thanks for the PR, and apologies for the delay.

Heads-up: we just merged a large internal iteration into main (#17), so this
PR is based on an outdated baseline. We re-verified your findings against the
new main and the problem is still there:

• apps/rlark/pkg/server/ssh_server.go still takes the DB-backed branch when
  userKeyStore != nil and returns an empty key ID instead of falling through
  to the Secret-based lookup
• AddSSHUserKey in apps/rlark/pkg/db/models.go still has no callers, so the
  ssh_user_keys table is never populated — any deployment configured with a DB
  rejects every key added through the UI

One thing to watch when you rebase: #17 rewrote a large part of
apps/rlark/docs/concepts.md, so the documentation hunk in this PR will need to
be re-applied by hand. The incorrect Secret name (rlark-ssh-user-keys, which
should match common.SSHUserKeySecretName = rlark-ssh-keys) has moved to
line 659 in both docs/concepts.md and docs/zh/concepts.md.

Could you please:

1. Rebase onto the latest main.
2. Re-apply the concepts.md / zh/concepts.md change at its new location.
3. Re-run the tests and push, and we'll review again.

Thanks for digging into this — the dead-code path was easy to miss.