fix: interface_name strategy, instance hosts in sftp/scp, alias rewrites

Found by the new Docker test environment against a real NetBox 4.7:

- The interface_name strategy filtered IP addresses with interface_name
  and vminterface_name, which NetBox ignores, so it returned the first
  address of the host instead of the named interface's. Use the real
  filters interface and vminterface; a missing interface (HTTP 400)
  falls through to the next strategy.
- sftp and scp took instance-qualified hosts (prod/web01:/path) for
  local paths, because a "/" comes before the ":". Such arguments are
  remote when the prefix is a configured NetBox instance.
- Shell aliases of instance-qualified hosts ran the shortcut rules on
  "instance/host", so anchored rewrite rules never matched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/ssh/client.go

@@ -13,6 +13,18 @@ type Client struct {
 	port    byte          // flag for the port: -p (ssh) or -P (sftp, scp)
 	user    byte          // flag for the login user; 0 when only user@ or -o User work
 	paths   bool          // destinations are host[:path]
+	// instances are the configured NetBox instance names; "inst/host:path"
+	// is remote only for these, so local paths like "dir/file:x" stay local.
+	instances map[string]bool
+}
+
+// WithInstances returns c aware of the NetBox instance prefixes in host:path.
+func (c Client) WithInstances(names []string) Client {
+	c.instances = make(map[string]bool, len(names))
+	for _, name := range names {
+		c.instances[strings.ToLower(name)] = true
+	}
+	return c
 }
 
 var (
@@ -61,7 +73,7 @@ func (c Client) Operands(args []string) ([]Operand, error) {
 		if strings.HasPrefix(arg, "scp://") || strings.HasPrefix(arg, "sftp://") {
 			return nil, fmt.Errorf("%q: use host:path instead of a URI", arg)
 		}
-		dest, path, remote := splitRemote(arg)
+		dest, path, remote := c.splitRemote(arg)
 		if !remote {
 			continue
 		}
@@ -105,9 +117,22 @@ func (c Client) insertionPoint(args []string) int {
 	return len(args)
 }
 
-// splitRemote mirrors scp's colon(): an argument is remote when a ':' comes
+// splitRemote is splitHostPath with netssh's [user@]instance/host:path form.
+func (c Client) splitRemote(arg string) (dest, path string, remote bool) {
+	if head, rest, ok := strings.Cut(arg, "/"); ok {
+		instance := head[strings.LastIndex(head, "@")+1:]
+		if c.instances[strings.ToLower(instance)] {
+			if d, p, r := splitHostPath(rest); r {
+				return head + "/" + d, p, true
+			}
+		}
+	}
+	return splitHostPath(arg)
+}
+
+// splitHostPath mirrors scp's colon(): an argument is remote when a ':' comes
 // before any '/'. A leading "[" starts a bracketed IPv6 address.
-func splitRemote(arg string) (dest, path string, remote bool) {
+func splitHostPath(arg string) (dest, path string, remote bool) {
 	if strings.HasPrefix(arg, "/") || strings.HasPrefix(arg, ".") {
 		return "", "", false
 	}