Add ProxyCommand support and make ProxyJump actually work

[ArielTM]

Summary

The README already advertises "proxy jump (bastion host)" support, but it turns out manager.rs never reads the proxy_jump field — the connection always goes direct TCP. So the field has been stored, imported from ~/.ssh/config, and editable in the UI, but ignored at connect time. This PR wires it up for real and adds ProxyCommand alongside it.

Highlights:

• New ProxyCommand field, end-to-end (struct → DB migration → form → import → connect).
• Single-hop ProxyJump now actually does something — native via russh's channel_open_direct_tcpip, no shell-out to system ssh.
• Both PTY (connect) and SFTP (connect_no_pty) paths go through one shared open_authenticated_handle helper, so SFTP gets proxy support automatically.
• ssh_config importer now picks up ProxyCommand directives (it was already grabbing ProxyJump).
• README tightened so it stops overstating what's shipped.

How it works

Transport selection (matches OpenSSH precedence: ProxyCommand wins if both are set):

1. ProxyCommand: tokens %h/%p/%r/%% are expanded, then the string is handed to sh -c (Unix) / cmd /C (Windows) via russh_config::Stream::proxy_command. Wrapping in a shell rather than calling Stream's built-in split(' ') keeps quotes, pipes, env vars and ~ expansion working — matters for anything copy-pasted from ~/.ssh/config.
2. ProxyJump: parse [user@]host[:port], recursively authenticate to the bastion (reusing the target's auth method), open a direct-tcpip channel to (target_host, target_port), then feed channel.into_stream() to russh::client::connect_stream for the target session. The bastion handle is kept alive in AuthenticatedHandle.jump_chain — dropping it would tear down the transport.
3. Neither set: plain TCP, same code path as before.

Multi-hop ProxyJump (a,b,c) is rejected with an error message pointing at ProxyCommand. ~95% of bastion setups are single-hop, and chains have an escape hatch via ProxyCommand ssh -J a,b,c -W %h:%p.

UI

HostEditModal gains a "Proxy / Jump host" section with two inputs:

• ProxyJump — [user@]host[:port]. Hint: "Single-hop only. Reuses this host's credentials to authenticate to the bastion."
• ProxyCommand — raw OpenSSH-style command. Hint: "Runs as a local subprocess. Tokens: %h host, %p port, %r remote user. If both proxy fields are set, ProxyCommand wins."

Why russh-config instead of building it ourselves

russh-config 0.48 provides Stream::tcp_connect / Stream::proxy_command returning an AsyncRead + AsyncWrite you can feed straight to russh::client::connect_stream. No need to hand-roll subprocess piping. Note: russh-config itself doesn't handle ProxyJump — its Config::stream() only does ProxyCommand. The jump logic in this PR uses raw russh channels.

The crate is added as a separate dep at "0.48". It's standalone (no transitive dep on russh), so the version skew with this project's russh = "0.46" doesn't matter.

Why native ProxyJump and not shell out to ssh -J

Shelling out to system ssh would have been ~2 lines (just feed it through ProxyCommand), but:

• Windows users without OpenSSH installed would silently lose ProxyJump support.
• known_hosts trust and ssh-agent keys would split between anyscp's own store and ~/.ssh/, leading to "works in Terminal but not in anyscp" support tickets.
• The app already owns the full SSH stack (PPK conversion, keychain, etc.) — going native here is consistent.

Files

File	Change
src-tauri/Cargo.toml	+ russh-config = "0.48"
src-tauri/src/types/session.rs	HostConfig gains proxy_jump, proxy_command
src-tauri/src/db/mod.rs	Migration 11→12 adds proxy_command column; SavedHost field + every SQL site
src-tauri/src/ssh/manager.rs	Shared open_authenticated_handle; transport builder; token expansion; jump-chain anchoring
src-tauri/src/ssh/session.rs	SshSession carries the optional jump_chain anchor
src-tauri/src/ssh/commands.rs, portforward/commands.rs	Forward proxy fields when building HostConfig
src-tauri/src/import/mod.rs	Enable ALLOW_UNSUPPORTED_FIELDS; extract ProxyCommand from unsupported_fields["proxycommand"]
src-tauri/src/import/commands.rs	Pass proxy_command through to SavedHost
src-tauri/tests/proxy_command_import.rs	Integration test pinning the ssh2-config assumption
src/types/ssh.ts	TS types updated
src/components/dashboard/HostEditModal.tsx	New section + form fields + state wiring
src/components/dashboard/ImportSshConfigModal.tsx	Forward proxy_command on import
README.md	Updated to match shipped behaviour
pnpm-workspace.yaml	Approve esbuild build script + disable pnpm 11's pre-flight deps check (otherwise pnpm tauri dev errors on a fresh checkout)

Test plan

• cargo check clean
• cargo test --lib — 7 new unit tests for expand_proxy_command_tokens and parse_proxy_jump, all pass
• cargo test --test proxy_command_import — verifies ssh2-config behaviour our extractor depends on
• tsc --noEmit clean
• Manual: DB migration 11→12 ran against an existing anyscp.db without losing data
• Manual: imported ~/.ssh/config with ProxyCommand /path/to/script %h %p — value appears in the DB and the host edit modal
• Manual: connect through ProxyCommand against a working AWS SSM ssh-proxy script

Things that are intentionally out of scope:

• Multi-hop ProxyJump (errors with a clear pointer to ProxyCommand).
• Separate credentials for the jump host (reuses target's auth).
• "Test connection" button (the existing Save-and-connect flow is the de-facto test).