fixes and improvements

backend/src/media_library_viewer_api/clients/ssh.py

@@ -20,6 +20,8 @@ from typing import Any
 
 import paramiko
 
+from media_library_viewer_api.services.known_hosts import ensure_known_host
+
 logger = logging.getLogger(__name__)
 
 
@@ -64,12 +66,14 @@ class RemoteSSHClient:
     def connect(self) -> paramiko.SSHClient:
         """Create or reuse the Paramiko connection.
 
-        Unknown host keys are rejected. The application can synthesize a managed
-        known_hosts file under its cache directory so users do not need to mount
-        their local SSH directory into the container.
+        Unknown host keys are recorded on first contact in the managed
+        known_hosts file when one is configured. After that, strict checking
+        remains in effect so host key changes are still rejected.
         """
         if self._client:
             return self._client
+        if self.known_hosts_path:
+            ensure_known_host(self.host, self.port, Path(self.known_hosts_path), strict=True)
         client = paramiko.SSHClient()
         client.load_system_host_keys()
         if self.known_hosts_path and Path(self.known_hosts_path).is_file():