feat: netssh multi — several hosts side by side in tmux or zellij

netssh multi opens one pane per host in a tmux window or zellij tab.
Hosts come from names, tag:TAG (NetBox and static hosts), cluster:NAME
(NetBox virtualization clusters; devices by default, --kind vm|all),
and groups from the config (@name, nested, with cycle detection).
Every pane runs netssh HOST, so lookup, rules, and jump hosts apply.

- tmux: a new window inside tmux, else a new session that is attached;
  tiled layout, pane borders with the host and a [SYNC] marker.
- zellij: a generated grid layout; a new tab inside zellij, else a new
  session.
- --sync broadcasts typing to all panes; netssh sync toggles it in the
  current tmux window or zellij tab.
- TUI: Space marks hosts, Ctrl+A marks all, Enter opens them together.
- Configurator: multiplexer, panes per window, groups.

NetBox SearchAll gains a cluster filter (name to cluster IDs per
instance), and cache entries keep the host's cluster for completion
and an offline fallback. Panes skip the 24-hour background refresh
(checked once by multi) and get HOME/XDG paths but no NETSSH_* values,
which would expose tokens in the process list.

testenv/tests/15-multi.sh checks real tmux and zellij sessions,
including a broadcast command arriving on all three cluster nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/multi.go

@@ -0,0 +1,57 @@
+package config
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// MultiConfig controls netssh multi.
+type MultiConfig struct {
+	// Multiplexer is auto, tmux, or zellij; empty means auto.
+	Multiplexer string `mapstructure:"multiplexer"`
+	// PanesPerWindow splits larger host lists into more windows or tabs; 0 = 9.
+	PanesPerWindow int `mapstructure:"panes_per_window"`
+}
+
+// DefaultPanesPerWindow keeps panes readable on a normal screen (3×3).
+const DefaultPanesPerWindow = 9
+
+// ValidateMulti checks groups and the multi settings.
+func (c *Config) ValidateMulti() error {
+	switch c.Multi.Multiplexer {
+	case "", "auto", "tmux", "zellij":
+	default:
+		return fmt.Errorf("multi.multiplexer must be auto, tmux, or zellij")
+	}
+	if c.Multi.PanesPerWindow < 0 || c.Multi.PanesPerWindow > 64 {
+		return fmt.Errorf("multi.panes_per_window must be between 1 and 64")
+	}
+	names := make([]string, 0, len(c.Groups))
+	for name := range c.Groups {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		if !instanceName.MatchString(name) {
+			return fmt.Errorf("groups: name %q must contain only letters, digits, underscores, or hyphens", name)
+		}
+		if len(c.Groups[name]) == 0 {
+			return fmt.Errorf("groups.%s: needs at least one host or selector", name)
+		}
+		for _, selector := range c.Groups[name] {
+			if strings.TrimSpace(selector) == "" || strings.ContainsAny(selector, " \t\n") || strings.HasPrefix(selector, "-") {
+				return fmt.Errorf("groups.%s: invalid entry %q", name, selector)
+			}
+		}
+	}
+	return nil
+}
+
+// PanesPerWindowOrDefault returns the configured value or the default.
+func (m MultiConfig) PanesPerWindowOrDefault() int {
+	if m.PanesPerWindow > 0 {
+		return m.PanesPerWindow
+	}
+	return DefaultPanesPerWindow
+}