Add the SSH gateway for session-provider hosts

[czpython]

Part of #14 (M1 + M2).

Summary

Sandboxes have no dialable address: the daemon stops them when idle and owns the data plane. The gateway gives their hosts a normal SSH path.

ssh -p 2222 -i <private-key> <host-name>@<gateway-address>

The gateway authenticates the key against the host's stored public key, requires the username to name the same host, and opens an sbx exec session. A stopped sandbox wakes on connect (~6 s) and stays awake while connected. A shell and command execution only; SFTP, scp, and port forwarding are refused.

Changes

• src/gateway/: the asyncssh server, python -m gateway.server.
• Gateway providers declare their session process; docker-sbx dials sbx exec, with a local PTY pair when the caller requests a terminal, and a separate error stream in pipe mode.
• Migration 0003: hosts.public_key stores the public half of the per-host keypair.
• Session-provider hosts advertise the gateway coordinates; known_hosts pins the gateway's host key.
• docs/deploy.md: gateway section and settings.

Verification

• ruff, format, pyright: clean; pytest: 393 pass
• End to end on a real host, in host mode and containerized: create, exec with exit codes, PTY, sleep/wake, renew, delete, 5 parallel hosts with parallel gateway sessions
• Playwright conformance (DEFAULT_HOST_PROVIDER=docker-sbx): 9 passed, 1 skipped in both modes