feat: SSH key management in KeeAgent entry panel

[steffen-heil]

Summary

• Generate keys — new "Generate new Ed25519 key" option in the key location dialog creates an id_ed25519 / id_ed25519.pub attachment pair; warns before overwriting an existing key
• Decrypt in place — new "Decrypt existing key" option decrypts an encrypted key attachment using the entry's password field (resolved via SprEngine field references, matching normal key-load behaviour); replaces the attachment with an unencrypted copy
• Edit comment — the comment field in Key Info becomes editable for unencrypted attachment keys; the agent key is swapped atomically on entry-dialog OK (not on focus-loss), preserving all constraints (confirm, lifetime, destination)

Details

SshKeyGenerator.cs — new standalone static class:

• Generate — Ed25519 key pair via BouncyCastle, OpenSSH wire format, zeroes raw key material in finally blocks
• ChangeComment — re-serialises an unencrypted private key with a new comment
• Decrypt — decrypts an encrypted key and re-serialises it without cipher/kdf
• BuildDecryptedPrivateKey / WriteDecryptedKeyMaterial — shared OpenSSH format builder supporting Ed25519, RSA, ECDSA, DSA, Ed448

KeyLocationPanel — fourth radio button "Decrypt existing key (uses entry password)"; enabled only when the current attachment is encrypted and a passphrase is available

ManageKeyFileDialog — UpdateDecryptEnabled() called on load and on every KeyLocationChanged event so decrypt availability is always current

EntryPanel — comment textbox becomes editable for unencrypted attachment keys; defers live agent reload to FormClosing(DialogResult.OK) to avoid mutating the agent on cancel

Test plan

• Generate: entry → SSH Agent tab → Manage → "Generate new key" → OK → id_ed25519 and id_ed25519.pub appear in Attachments
• Generate: repeat with existing id_ed25519 → overwrite warning appears
• Decrypt: encrypted key attachment + matching password → Manage → "Decrypt existing key" enabled → OK → attachment is now unencrypted
• Decrypt: password stored as KeePass field reference → decrypt resolves it correctly
• Decrypt radio: switch attachment selection inside Manage → decrypt availability updates immediately
• Comment: unencrypted key → edit comment → tab away → Cancel entry dialog → agent retains original comment
• Comment: same but click OK → agent key shows new comment, all constraints preserved

🤖 Generated with Claude Code

[steffen-heil]

Any chance this will be merged? (Already using this in production)