feat(ssh): jump hosts, host key checking, and configurable ssh options

Add SSH settings that apply only to netssh connections, so
~/.ssh/config does not need global changes:

- proxy_jump (passed as -J; "none" disables an inherited jump host)
- host_key_checking: strict | accept-new | off (off prints a notice)
- target: ip (default) | name | hostname; "name" connects to the
  NetBox name with -o HostName=<ip> and -o HostKeyAlias=<name>, so
  `Host *.example.com` rules apply and known_hosts entries follow the
  device instead of a reused IP
- address_family: any | inet | inet6
- options (-o Key=Value) and extra_args

Settings layer global -> netboxes[].ssh -> ssh.rules (match by tag,
instance, kind, or name glob). Options given on the command line
always win: -o values are inserted after the user's own, and
extra_args before them.

New wrapper flags: --jump HOST, --no-jump, and --dry-run, which prints
the final ssh command instead of connecting. The TUI uses the same
options. The setup wizard keeps all new settings when it saves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/netssh/main.go

@@ -81,16 +81,21 @@ func loadConfigOrSetup() *config.Config {
 
 // runSSHWrapper resolves the target hostname via NetBox and execs the native ssh binary.
 func runSSHWrapper(args []string) {
+	flags, args, err := internalssh.ExtractWrapperFlags(args)
+	if err != nil {
+		fatalf("%v", err)
+	}
 	cfg := loadConfigOrSetup()
 
 	parsed := internalssh.Parse(args)
 	if parsed == nil {
 		// No destination found — pass arguments straight through to ssh.
-		if err := internalssh.Exec(args); err != nil {
-			fatalf("%v", err)
-		}
+		execSSH(internalssh.Result{Args: args}, flags)
 		return
 	}
+	connect := func(name, kind, ip string, tags []string) {
+		connectHost(cfg, flags, name, kind, ip, tags, parsed.DestIdx, args)
+	}
 
 	// Inject the configured default user if none was given on the command line.
 	if cfg.SSH.DefaultUser != "" && parsed.User == "" && !internalssh.HasUserFlag(args) {
@@ -114,7 +119,7 @@ func runSSHWrapper(args []string) {
 	if entry, fresh := c.Get(parsed.Host); fresh && useCache {
 		c.MarkUsed(parsed.Host)
 		_ = c.Save()
-		connect(entry.IP, parsed, args)
+		connect(entry.Name, entry.Kind, entry.IP, entry.Tags)
 		return
 	}
 
@@ -132,7 +137,7 @@ func runSSHWrapper(args []string) {
 			if fresh {
 				c.MarkUsed(entry.Name)
 				_ = c.Save()
-				connect(entry.IP, parsed, args)
+				connect(entry.Name, entry.Kind, entry.IP, entry.Tags)
 				return
 			}
 			// Stale shortcut match — use canonical name for NetBox re-fetch.
@@ -165,7 +170,7 @@ func runSSHWrapper(args []string) {
 	if cached, fresh := c.Get(target.Target()); fresh && cached.Kind == target.Kind {
 		c.MarkUsed(target.Target())
 		_ = c.Save()
-		connect(cached.IP, parsed, args)
+		connect(cached.Name, cached.Kind, cached.IP, cached.Tags)
 		return
 	}
 
@@ -183,7 +188,7 @@ func runSSHWrapper(args []string) {
 	c.MarkUsed(target.Target())
 	_ = c.Save()
 
-	connect(ip, parsed, args)
+	connect(target.Target(), target.Kind, ip, target.Tags)
 }
 
 // findSSHHost uses the paginated, ambiguity-checking lookup for connection
@@ -206,9 +211,24 @@ func findSSHHost(ctx context.Context, client *netbox.Client, name string, domain
 	return netbox.HostEntry{}, fmt.Errorf("%w: %q", netbox.ErrHostNotFound, name)
 }
 
-func connect(ip string, parsed *internalssh.ParsedArgs, originalArgs []string) {
-	newArgs := internalssh.ReplaceHost(originalArgs, parsed.DestIdx, ip)
-	if err := internalssh.Exec(newArgs); err != nil {
+// connectHost applies the SSH options configured for the host and execs ssh.
+// target is the cache/selector name, which may carry an instance prefix.
+func connectHost(cfg *config.Config, flags internalssh.WrapperFlags, target, kind, ip string, tags []string, destIdx int, args []string) {
+	instance, name := netbox.SplitTarget(target)
+	opts := cfg.SSHOptionsFor(config.SSHHost{Instance: instance, Name: name, Kind: kind, Tags: tags})
+	execSSH(internalssh.Apply(args, destIdx, internalssh.Host{Name: name, IP: ip}, opts, flags), flags)
+}
+
+// execSSH replaces the process with ssh, or prints the command for --dry-run.
+func execSSH(result internalssh.Result, flags internalssh.WrapperFlags) {
+	if flags.DryRun {
+		fmt.Println(internalssh.Quote(append([]string{"ssh"}, result.Args...)))
+		return
+	}
+	if result.Notice != "" {
+		fmt.Fprintf(os.Stderr, "netssh: %s\n", result.Notice)
+	}
+	if err := internalssh.Exec(result.Args); err != nil {
 		fatalf("%v", err)
 	}
 }
@@ -244,8 +264,10 @@ func runTUI() {
 	}
 
 	// Revalidate stale or live TUI results through the configured resolver chain.
+	var tags []string
 	if cached, fresh := c.Get(host.Name); fresh && cached.Kind == host.Kind {
 		host.IP = cached.IP
+		tags = cached.Tags
 	} else {
 		if nbClient == nil {
 			fatalf("cannot resolve %q: NetBox is not configured", host.Name)
@@ -265,6 +287,7 @@ func runTUI() {
 			fatalf("IP resolution: %v", err)
 		}
 		c.Upsert(cache.Entry{Name: target.Target(), IP: host.IP, Kind: target.Kind, Tags: target.Tags})
+		tags = target.Tags
 	}
 	fmt.Fprintf(os.Stderr, "Connecting to %s (%s)…\n", host.Name, host.IP)
 
@@ -292,9 +315,7 @@ func runTUI() {
 	c.MarkUsed(host.Name)
 	_ = c.Save()
 
-	if err := internalssh.Exec(sshArgs); err != nil {
-		fatalf("%v", err)
-	}
+	connectHost(cfg, internalssh.WrapperFlags{}, host.Name, host.Kind, host.IP, tags, len(sshArgs)-1, sshArgs)
 }
 
 // --- cobra root + subcommands ---