feat: implement repository clone mode with SSH key support

- Add clone_mode and branch fields to tool_instances
- Add ssh_key_id to git_repositories for per-repo SSH key assignment
- Implement host-side git cloning with branch selection (default: main)
- Mount SSH keys into containers for git operations in clone mode
- Add dirty state check on clone-mode instance deletion with confirmation
- Update SessionsPage with mount/clone selector, branch input, SSH key display
- Add SSH key selector to repository creation form
- Add dirty delete confirmation modal with changed files list
- Update API schemas and endpoints for new fields
- Sync delta specs to main specs (git-repo, tool-instances, repo-clone-mode)
- Archive completed OpenSpec change: repo-clone-mode-with-ssh
- Document git requirement for custom tool types

Quality gates: Frontend typecheck and build passed
OpenSpec: repo-clone-mode-with-ssh archived with all tasks complete

openspec/changes/archive/2026-05-22-session-management-fixes/specs/tunnel-health-monitoring/spec.md

@@ -0,0 +1,35 @@
+## ADDED Requirements
+
+### Requirement: System monitors tunnel health
+The system SHALL periodically check if active tunnel URLs are reachable and mark them as erroneous if not.
+
+#### Scenario: Healthy tunnel
+- **WHEN** a tunnel health check is performed on a running instance
+- **THEN** the system receives an HTTP 2xx response
+- **AND** the instance status remains "running"
+
+#### Scenario: Broken tunnel
+- **WHEN** a tunnel health check is performed on a running instance
+- **AND** the response is not HTTP 2xx or the request fails
+- **THEN** the instance is marked with tunnel_error status
+- **AND** a visual error indicator is displayed in the UI
+
+### Requirement: Users can recreate broken tunnels
+The system SHALL allow users to regenerate a temporary tunnel for a running instance without restarting the instance.
+
+#### Scenario: Recreate tunnel
+- **WHEN** user clicks "Recreate Tunnel" button on an instance with a broken tunnel
+- **THEN** the system stops the existing cloudflared process
+- **AND** starts a new cloudflared tunnel
+- **AND** updates the instance URL
+- **AND** the new URL is displayed in the UI
+
+#### Scenario: Recreate tunnel success
+- **WHEN** tunnel recreation completes successfully
+- **THEN** the error indicator is removed
+- **AND** the instance shows as healthy
+
+#### Scenario: Recreate tunnel failure
+- **WHEN** tunnel recreation fails
+- **THEN** the error indicator remains
+- **AND** an error message is displayed to the user