feat: add ssh_key_id to config profiles for container key mounting

- Add ssh_key_id column to ConfigProfile model and migration
- Update config profile API to accept/return ssh_key_id
- Include ssh_key_id in ResolvedProfile and resolver logic
- Mount selected SSH key into container home dir at start_instance
- Frontend config profile form with SSH key selector dropdown
- Git mount URL validation defaults to profile's SSH key

Quality gates: pytest (231 passed, 6 pre-existing), tsc --noEmit clean

openspec/explorations/ssh-key-mounting.md

@@ -0,0 +1,29 @@
+# Exploration: SSH Key Mounting in Config Profiles
+
+## Current State
+- SSH keys are stored in `ssh_keys` table, user-scoped
+- Keys are attached to `GitRepository` via `ssh_key_id`
+- On clone-mode instance start, the repo's key is mounted to `/root/.ssh`
+- `prepare_ssh_key_files` writes to `instance_dir/.ssh`
+- Only works for clone mode; always mounts to `/root/.ssh`
+
+## Problem
+1. Keys are tied to repositories, not selectable per-instance or per-profile
+2. Always mounted to `/root/.ssh`, not the container user's home dir
+3. Only clone-mode instances get SSH keys; mount-mode instances can't use SSH
+
+## Solution
+Add `ssh_key_id` to ConfigProfile. When a profile with an SSH key is applied:
+1. Fetch the SSH key
+2. Stage decrypted files to `instance_dir/mounts/ssh/.ssh`
+3. Add volume mount to compose: `instance_dir/mounts/ssh/.ssh` → `{home_dir}/.ssh`
+4. This works for all instance types (manifest, legacy, clone, mount)
+
+## Files to Change
+- `apps/api/src/models/config_profile.py` — add `ssh_key_id` column
+- `apps/api/alembic/versions/` — migration
+- `apps/api/src/services/config_profile_resolver.py` — resolve + apply
+- `apps/api/src/services/ssh_keys.py` — allow custom output subdir
+- `apps/api/src/api/config_profiles.py` — CRUD + validation
+- `apps/web/src/api/config_profiles.ts` — type + API
+- `apps/web/src/pages/config-profiles.tsx` — SSH key selector UI