feat: add ssh_key_id to config profiles for container key mounting

- Add ssh_key_id column to ConfigProfile model and migration
- Update config profile API to accept/return ssh_key_id
- Include ssh_key_id in ResolvedProfile and resolver logic
- Mount selected SSH key into container home dir at start_instance
- Frontend config profile form with SSH key selector dropdown
- Git mount URL validation defaults to profile's SSH key

Quality gates: pytest (231 passed, 6 pre-existing), tsc --noEmit clean

apps/web/src/api/config_profiles.ts

@@ -12,6 +12,7 @@ export interface ConfigProfile {
 	mounts: ConfigProfileMount[];
 	git_mounts: GitMount[];
 	files: Record<string, string>;
+	ssh_key_id: string | null;
 	is_default: boolean;
 	includes: ConfigProfileInclude[];
 	created_at: string;
@@ -52,6 +53,7 @@ export interface ResolvedProfile {
 	mounts: ResolvedMount[];
 	git_mounts: GitMount[];
 	files: Record<string, string>;
+	ssh_key_id: string | null;
 	overrides: {
 		env_vars: Record<string, string>;
 		runtime_hints: Record<string, string>;
@@ -78,6 +80,7 @@ export interface CreateConfigProfileRequest {
 	mounts?: ConfigProfileMount[];
 	git_mounts?: GitMount[];
 	files?: Record<string, string>;
+	ssh_key_id?: string;
 	is_default?: boolean;
 }
 
@@ -91,6 +94,7 @@ export interface UpdateConfigProfileRequest {
 	mounts?: ConfigProfileMount[];
 	git_mounts?: GitMount[];
 	files?: Record<string, string>;
+	ssh_key_id?: string;
 	is_default?: boolean;
 }