feat: add safe Gitea sync and signed updates

tests/ssh-service.test.mjs

@@ -73,6 +73,35 @@ test("connection options enforce host identity and support password credentials"
   const firstUse = await service.connectionOptions({ id: 'one', host: 'server', username: 'root', authType: 'password' }, { trustOnFirstUse: true });
   assert.equal(firstUse.options.port, 22);
   assert.equal(firstUse.options.hostVerifier(key), true);
+  const previewBound = await service.connectionOptions(
+    { id: 'one', host: 'server', username: 'root', authType: 'password' },
+    { expectedFingerprint: fingerprint },
+  );
+  assert.equal(previewBound.options.hostVerifier(key), true);
+  assert.equal(previewBound.options.hostVerifier(Buffer.from('changed')), false);
+});
+
+test("SSH host fingerprint preview rejects the handshake before credentials are requested", async () => {
+  const key = Buffer.from("untrusted-server-key");
+  let connectedOptions = null;
+  class ProbeClient extends EventEmitter {
+    connect(options) {
+      connectedOptions = options;
+      assert.equal(options.hostVerifier(key), false);
+      queueMicrotask(() => this.emit("error", Object.assign(new Error("host rejected"), { code: "HOST_VERIFIER_REJECTED" })));
+    }
+    end() {}
+  }
+  const store = {
+    getServer: () => ({ id: "server", name: "Unraid", host: "192.0.2.10", port: 2222, username: "root", authType: "password" }),
+    getServerCredentials: () => { throw new Error("credentials must not be read during a fingerprint preview"); },
+  };
+  const service = new SshService({ store, diagnostics: null, clientFactory: () => ProbeClient });
+  const result = await service.probeHostFingerprint("server");
+  assert.equal(result.fingerprint, fingerprintKey(key));
+  assert.deepEqual(result.server, { id: "server", name: "Unraid", host: "192.0.2.10", port: 2222 });
+  assert.equal("password" in connectedOptions, false);
+  assert.equal("privateKey" in connectedOptions, false);
 });
 
 test("connection options report unreadable private keys without leaking credentials", async () => {