feat: instance-level SSH key selection for container mounting

- Revert mistaken ssh_key_id from ConfigProfile (model, API, resolver, frontend)
- Add ssh_key_ids JSON column to tool_instances via migration
- Update create_instance to accept and store ssh_key_ids
- Update start_instance to mount selected SSH keys to {home_dir}/.ssh
- Update list_instances to return ssh_key_ids
- Frontend CreateSessionForm: multi-select SSH key checkboxes
- Frontend instance-list: SSH key selector for start/restart actions
- Maintain separate SSH key dirs per key to avoid conflicts

Quality gates: pytest (231 passed, 6 pre-existing), tsc --noEmit clean

apps/web/src/api/config_profiles.ts

@@ -12,7 +12,6 @@ export interface ConfigProfile {
 	mounts: ConfigProfileMount[];
 	git_mounts: GitMount[];
 	files: Record<string, string>;
-	ssh_key_id: string | null;
 	is_default: boolean;
 	includes: ConfigProfileInclude[];
 	created_at: string;
@@ -53,7 +52,6 @@ export interface ResolvedProfile {
 	mounts: ResolvedMount[];
 	git_mounts: GitMount[];
 	files: Record<string, string>;
-	ssh_key_id: string | null;
 	overrides: {
 		env_vars: Record<string, string>;
 		runtime_hints: Record<string, string>;
@@ -80,7 +78,6 @@ export interface CreateConfigProfileRequest {
 	mounts?: ConfigProfileMount[];
 	git_mounts?: GitMount[];
 	files?: Record<string, string>;
-	ssh_key_id?: string;
 	is_default?: boolean;
 }
 
@@ -94,7 +91,6 @@ export interface UpdateConfigProfileRequest {
 	mounts?: ConfigProfileMount[];
 	git_mounts?: GitMount[];
 	files?: Record<string, string>;
-	ssh_key_id?: string;
 	is_default?: boolean;
 }