feat: add ssh_key_id to config profiles for container key mounting

- Add ssh_key_id column to ConfigProfile model and migration
- Update config profile API to accept/return ssh_key_id
- Include ssh_key_id in ResolvedProfile and resolver logic
- Mount selected SSH key into container home dir at start_instance
- Frontend config profile form with SSH key selector dropdown
- Git mount URL validation defaults to profile's SSH key

Quality gates: pytest (231 passed, 6 pre-existing), tsc --noEmit clean

openspec/changes/ssh-key-mounting/.openspec.yaml

@@ -0,0 +1,26 @@
+name: ssh-key-mounting
+status: implementing
+priority: high
+created_at: 2026-05-28
+updated_at: 2026-05-28
+labels:
+  - feature
+  - ssh
+  - config-profiles
+stories:
+  - title: Select SSH key in config profile
+    description: |
+      Add ssh_key_id to ConfigProfile so users can select an SSH key
+      to mount into container home directory (~/.ssh) when starting
+      a tool instance with that profile.
+    acceptance_criteria:
+      - ConfigProfile model has nullable ssh_key_id column
+      - Config profile API accepts/returns ssh_key_id
+      - ResolvedProfile includes ssh_key_id
+      - start_instance mounts SSH key to {home_dir}/.ssh after applying profile
+      - Frontend config profile form has SSH key selector dropdown
+      - Git mount URL validation defaults to profile's SSH key
+    tests:
+      - unit: test_config_profile_resolver.py (resolver includes ssh_key_id)
+      - unit: test_tool_instances_legacy.py (ssh key mount integration)
+    estimated_effort: small

openspec/explorations/ssh-key-mounting.md

@@ -0,0 +1,29 @@
+# Exploration: SSH Key Mounting in Config Profiles
+
+## Current State
+- SSH keys are stored in `ssh_keys` table, user-scoped
+- Keys are attached to `GitRepository` via `ssh_key_id`
+- On clone-mode instance start, the repo's key is mounted to `/root/.ssh`
+- `prepare_ssh_key_files` writes to `instance_dir/.ssh`
+- Only works for clone mode; always mounts to `/root/.ssh`
+
+## Problem
+1. Keys are tied to repositories, not selectable per-instance or per-profile
+2. Always mounted to `/root/.ssh`, not the container user's home dir
+3. Only clone-mode instances get SSH keys; mount-mode instances can't use SSH
+
+## Solution
+Add `ssh_key_id` to ConfigProfile. When a profile with an SSH key is applied:
+1. Fetch the SSH key
+2. Stage decrypted files to `instance_dir/mounts/ssh/.ssh`
+3. Add volume mount to compose: `instance_dir/mounts/ssh/.ssh` → `{home_dir}/.ssh`
+4. This works for all instance types (manifest, legacy, clone, mount)
+
+## Files to Change
+- `apps/api/src/models/config_profile.py` — add `ssh_key_id` column
+- `apps/api/alembic/versions/` — migration
+- `apps/api/src/services/config_profile_resolver.py` — resolve + apply
+- `apps/api/src/services/ssh_keys.py` — allow custom output subdir
+- `apps/api/src/api/config_profiles.py` — CRUD + validation
+- `apps/web/src/api/config_profiles.ts` — type + API
+- `apps/web/src/pages/config-profiles.tsx` — SSH key selector UI