feat: add ssh_key_id to config profiles for container key mounting

- Add ssh_key_id column to ConfigProfile model and migration
- Update config profile API to accept/return ssh_key_id
- Include ssh_key_id in ResolvedProfile and resolver logic
- Mount selected SSH key into container home dir at start_instance
- Frontend config profile form with SSH key selector dropdown
- Git mount URL validation defaults to profile's SSH key

Quality gates: pytest (231 passed, 6 pre-existing), tsc --noEmit clean

openspec/changes/ssh-key-mounting/.openspec.yaml

@@ -0,0 +1,26 @@
+name: ssh-key-mounting
+status: implementing
+priority: high
+created_at: 2026-05-28
+updated_at: 2026-05-28
+labels:
+  - feature
+  - ssh
+  - config-profiles
+stories:
+  - title: Select SSH key in config profile
+    description: |
+      Add ssh_key_id to ConfigProfile so users can select an SSH key
+      to mount into container home directory (~/.ssh) when starting
+      a tool instance with that profile.
+    acceptance_criteria:
+      - ConfigProfile model has nullable ssh_key_id column
+      - Config profile API accepts/returns ssh_key_id
+      - ResolvedProfile includes ssh_key_id
+      - start_instance mounts SSH key to {home_dir}/.ssh after applying profile
+      - Frontend config profile form has SSH key selector dropdown
+      - Git mount URL validation defaults to profile's SSH key
+    tests:
+      - unit: test_config_profile_resolver.py (resolver includes ssh_key_id)
+      - unit: test_tool_instances_legacy.py (ssh key mount integration)
+    estimated_effort: small