feat: netssh multi — several hosts side by side in tmux or zellij

netssh multi opens one pane per host in a tmux window or zellij tab.
Hosts come from names, tag:TAG (NetBox and static hosts), cluster:NAME
(NetBox virtualization clusters; devices by default, --kind vm|all),
and groups from the config (@name, nested, with cycle detection).
Every pane runs netssh HOST, so lookup, rules, and jump hosts apply.

- tmux: a new window inside tmux, else a new session that is attached;
  tiled layout, pane borders with the host and a [SYNC] marker.
- zellij: a generated grid layout; a new tab inside zellij, else a new
  session.
- --sync broadcasts typing to all panes; netssh sync toggles it in the
  current tmux window or zellij tab.
- TUI: Space marks hosts, Ctrl+A marks all, Enter opens them together.
- Configurator: multiplexer, panes per window, groups.

NetBox SearchAll gains a cluster filter (name to cluster IDs per
instance), and cache entries keep the host's cluster for completion
and an offline fallback. Panes skip the 24-hour background refresh
(checked once by multi) and get HOME/XDG paths but no NETSSH_* values,
which would expose tokens in the process list.

testenv/tests/15-multi.sh checks real tmux and zellij sessions,
including a broadcast command arriving on all three cluster nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/netssh/multi_test.go

@@ -0,0 +1,92 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.zb-server.de/Sebi/ssh-netbox-wrapper/internal/cache"
+	"git.zb-server.de/Sebi/ssh-netbox-wrapper/internal/config"
+)
+
+func TestExpandSelectors(t *testing.T) {
+	cfg := &config.Config{
+		Hosts: []config.StaticHost{{Name: "box", Address: "10.0.0.1", Tags: []string{"Web Servers"}}},
+		Groups: map[string][]string{
+			"all":  {"@web", "db1", "box"},
+			"web":  {"web1", "tag:web-servers", "web1"},
+			"loop": {"@loop"},
+		},
+	}
+	c := cache.New(t.TempDir()+"/hosts.json", 60).WithStatic(cfg.Hosts)
+	got, _, err := expandSelectors(cfg, c, []string{"@all", "WEB1"}, "")
+	if err != nil || !reflect.DeepEqual(got, []string{"web1", "box", "db1"}) {
+		t.Fatalf("got %v %v", got, err)
+	}
+	if _, _, err := expandSelectors(cfg, c, []string{"@loop"}, ""); err == nil || !strings.Contains(err.Error(), "contains itself") {
+		t.Fatalf("cycle: %v", err)
+	}
+	if _, _, err := expandSelectors(cfg, c, []string{"@nope"}, ""); err == nil || !strings.Contains(err.Error(), "available: @all, @loop, @web") {
+		t.Fatalf("unknown group: %v", err)
+	}
+	if _, _, err := expandSelectors(cfg, c, []string{"tag:web-servers"}, "device"); err == nil {
+		t.Fatal("--kind device must exclude static hosts")
+	}
+}
+
+// Without a reachable NetBox, tag: and cluster: fall back to the cache.
+func TestExpandSelectorsCacheFallback(t *testing.T) {
+	cfg := &config.Config{NetBox: config.NetBoxConfig{URL: "http://127.0.0.1:1", Token: "t", TokenVersion: 1}}
+	c := cache.New(t.TempDir()+"/hosts.json", 60)
+	c.Upsert(cache.Entry{Name: "node2", Kind: "device", Cluster: "pve"})
+	c.Upsert(cache.Entry{Name: "node1", Kind: "device", Cluster: "pve", Tags: []string{"pve"}})
+	c.Upsert(cache.Entry{Name: "vm1", Kind: "vm", Cluster: "pve"})
+	got, warnings, err := expandSelectors(cfg, c, []string{"cluster:PVE"}, "")
+	if err != nil || !reflect.DeepEqual(got, []string{"node1", "node2"}) || len(warnings) != 1 {
+		t.Fatalf("devices: %v %v %v", got, warnings, err)
+	}
+	if got, _, _ := expandSelectors(cfg, c, []string{"cluster:pve"}, "all"); len(got) != 3 {
+		t.Fatalf("all: %v", got)
+	}
+	if _, _, err := expandSelectors(cfg, c, []string{"cluster:other"}, ""); err == nil || !strings.Contains(err.Error(), "--kind vm") {
+		t.Fatalf("empty cluster: %v", err)
+	}
+}
+
+func TestMultiLabelAndPaneArgv(t *testing.T) {
+	for selectors, want := range map[string]string{"@k8s": "k8s", "cluster:pve-fsn1": "pve-fsn1", "tag:a.b": "a-b", "a b": "multi"} {
+		if got := multiLabel(strings.Fields(selectors)); got != want {
+			t.Errorf("%q: got %q", selectors, got)
+		}
+	}
+	t.Setenv("XDG_CONFIG_HOME", "/cfg")
+	t.Setenv("NETSSH_NETBOX_TOKEN", "secret")
+	argv := strings.Join(paneArgv("prod/web1", multiFlags{user: "ops", jump: "jh"}), " ")
+	for _, want := range []string{"NETSSH_NO_REFRESH=1", "XDG_CONFIG_HOME=/cfg", "--jump jh -l ops prod/web1"} {
+		if !strings.Contains(argv, want) {
+			t.Errorf("argv lacks %q: %s", want, argv)
+		}
+	}
+	if strings.Contains(argv, "secret") {
+		t.Fatalf("token leaked into the pane arguments: %s", argv)
+	}
+}
+
+func TestMultiDryRun(t *testing.T) {
+	prepareConfig(t, "hosts:\n  - {name: a, address: 10.0.0.1, tags: [web]}\n  - {name: b, address: 10.0.0.2, tags: [web]}\ngroups:\n  web: [\"tag:web\"]\n")
+	out, err := runNetssh(t, "multi", "--dry-run", "--tmux", "--sync", "@web")
+	if err != nil {
+		t.Fatalf("%s %v", out, err)
+	}
+	for _, want := range []string{"# 2 hosts: a b", "tmux new-session -d -x 240 -y 70 -s netssh-web", "synchronize-panes on", "tmux attach-session -t netssh-web"} {
+		if !strings.Contains(out, want) {
+			t.Errorf("missing %q:\n%s", want, out)
+		}
+	}
+	if out, err := runNetssh(t, "multi", "--dry-run", "--zellij", "a", "b"); err != nil || !strings.Contains(out, `pane name="b"`) {
+		t.Errorf("zellij: %s %v", out, err)
+	}
+	if out, err := runNetssh(t, "sync"); err == nil || !strings.Contains(out, "inside tmux or zellij") {
+		t.Errorf("sync outside: %s %v", out, err)
+	}
+}