# Exploration: SSH Key Mounting in Config Profiles

## Current State
- SSH keys are stored in `ssh_keys` table, user-scoped
- Keys are attached to `GitRepository` via `ssh_key_id`
- On clone-mode instance start, the repo's key is mounted to `/root/.ssh`
- `prepare_ssh_key_files` writes to `instance_dir/.ssh`
- Only works for clone mode; always mounts to `/root/.ssh`

## Problem
1. Keys are tied to repositories, not selectable per-instance or per-profile
2. Always mounted to `/root/.ssh`, not the container user's home dir
3. Only clone-mode instances get SSH keys; mount-mode instances can't use SSH

## Solution
Add `ssh_key_id` to ConfigProfile. When a profile with an SSH key is applied:
1. Fetch the SSH key
2. Stage decrypted files to `instance_dir/mounts/ssh/.ssh`
3. Add volume mount to compose: `instance_dir/mounts/ssh/.ssh` → `{home_dir}/.ssh`
4. This works for all instance types (manifest, legacy, clone, mount)

## Files to Change
- `apps/api/src/models/config_profile.py` — add `ssh_key_id` column
- `apps/api/alembic/versions/` — migration
- `apps/api/src/services/config_profile_resolver.py` — resolve + apply
- `apps/api/src/services/ssh_keys.py` — allow custom output subdir
- `apps/api/src/api/config_profiles.py` — CRUD + validation
- `apps/web/src/api/config_profiles.ts` — type + API
- `apps/web/src/pages/config-profiles.tsx` — SSH key selector UI