[chiconws]

Summary

Moves the SSH host-key probe from the Home Assistant integration into the client and lets NanoKVMSSH trust one pinned key, so a caller can do trust-on-first-use for a new device without its own paramiko client.

Changes

• probe_host_key(host, port=22, timeout=10) reads the server's host key from the SSH handshake, without logging in, and returns an SSHHostKey with host, known_hosts_line and an OpenSSH-style fingerprint (SHA256:...). Failures raise NanoKVMSSHConnectionError.
• NanoKVMSSH(host_key=...) takes one known-hosts line and trusts only that key: the system known-hosts file isn't loaded. The key applies to the host being connected to, whatever names its line carries, so a device that changed address keeps its key. An invalid line raises ValueError up front; a different server key raises NanoKVMSSHConnectionError, as with known_hosts=.
• Docs. docs/ssh.md gains a "Trusting a new device" section.

Notes

• This replaces the integration's second paramiko client for the config-flow login check: NanoKVMSSH(host, host_key=line), authenticate(), then disconnect(). Storing the approved key stays in the integration.

Behaviour changes

None. All methods and parameters are additions.

Testing

515 unit tests pass, 8 of them new. The probe, the pinned login and the rejection of a different key run against a real in-process paramiko SSH server. Against devices:

• NanoKVM Pro 1.2.15 and NanoKVM PCIe 2.5.2: probe_host_key() returned the same ED25519 fingerprint as ssh-keyscan, and a login pinned to that key succeeded.