feat: netssh multi — several hosts side by side in tmux or zellij

netssh multi opens one pane per host in a tmux window or zellij tab.
Hosts come from names, tag:TAG (NetBox and static hosts), cluster:NAME
(NetBox virtualization clusters; devices by default, --kind vm|all),
and groups from the config (@name, nested, with cycle detection).
Every pane runs netssh HOST, so lookup, rules, and jump hosts apply.

- tmux: a new window inside tmux, else a new session that is attached;
  tiled layout, pane borders with the host and a [SYNC] marker.
- zellij: a generated grid layout; a new tab inside zellij, else a new
  session.
- --sync broadcasts typing to all panes; netssh sync toggles it in the
  current tmux window or zellij tab.
- TUI: Space marks hosts, Ctrl+A marks all, Enter opens them together.
- Configurator: multiplexer, panes per window, groups.

NetBox SearchAll gains a cluster filter (name to cluster IDs per
instance), and cache entries keep the host's cluster for completion
and an offline fallback. Panes skip the 24-hour background refresh
(checked once by multi) and get HOME/XDG paths but no NETSSH_* values,
which would expose tokens in the process list.

testenv/tests/15-multi.sh checks real tmux and zellij sessions,
including a broadcast command arriving on all three cluster nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/multiplex/tmux.go

@@ -0,0 +1,95 @@
+package multiplex
+
+import (
+	"strconv"
+	"strings"
+)
+
+// paneScript runs the pane's command and keeps a failed one on screen, so an
+// unreachable host shows its error instead of the pane vanishing.
+const paneScript = `"$@"; status=$?; if [ "$status" -ne 0 ]; then echo; echo "netssh exited with status $status, press Enter to close"; read -r _; fi`
+
+// tmuxArgv runs the pane through sh with argv as arguments: no quoting, and
+// independent of the user's default-shell (which may be fish).
+func tmuxArgv(p Pane) []string {
+	return append([]string{"sh", "-c", paneScript, "netssh-pane"}, p.Argv...)
+}
+
+// openTmux adds a window per chunk of panes: to the current session inside
+// tmux, else to a new detached session that is attached at the end.
+func openTmux(panes []Pane, opts Options, r Runner) error {
+	inside := r.Getenv("TMUX") != ""
+	session := ""
+	if !inside {
+		session = freeSession(r, "netssh-"+opts.Label)
+	}
+	groups := chunks(panes, opts.PerWindow)
+	first := ""
+	for i, group := range groups {
+		name := windowLabel(opts.Label, i, len(groups))
+		format := []string{"-P", "-F", "#{window_id} #{pane_id}", "-n", name}
+		var create []string
+		switch {
+		case inside:
+			create = append([]string{"tmux", "new-window"}, format...)
+		case i == 0:
+			// A large virtual size leaves room for the splits; attaching resizes it.
+			create = append([]string{"tmux", "new-session", "-d", "-x", "240", "-y", "70", "-s", session}, format...)
+		default:
+			create = append([]string{"tmux", "new-window", "-t", session + ":"}, format...)
+		}
+		out, err := r.Output(append(create, tmuxArgv(group[0])...)...)
+		if err != nil {
+			return err
+		}
+		window, pane, _ := strings.Cut(out, " ")
+		if first == "" {
+			first = window
+		}
+		paneIDs := []string{pane}
+		for _, p := range group[1:] {
+			id, err := r.Output(append([]string{"tmux", "split-window", "-t", window, "-P", "-F", "#{pane_id}"}, tmuxArgv(p)...)...)
+			if err != nil {
+				return err
+			}
+			paneIDs = append(paneIDs, id)
+			// Re-tile after every split so the next one still has room.
+			if _, err := r.Output("tmux", "select-layout", "-t", window, "tiled"); err != nil {
+				return err
+			}
+		}
+		for j, id := range paneIDs {
+			// A pane may already be gone (host unreachable and closed); not fatal.
+			_, _ = r.Output("tmux", "set-option", "-p", "-t", id, "@netssh_host", group[j].Title)
+		}
+		windowOptions := [][]string{
+			{"pane-border-status", "top"},
+			{"pane-border-format", " #{@netssh_host}#{?pane_synchronized, [SYNC],} "},
+		}
+		if opts.Sync {
+			windowOptions = append(windowOptions, []string{"synchronize-panes", "on"})
+		}
+		for _, option := range windowOptions {
+			if _, err := r.Output("tmux", "set-window-option", "-t", window, option[0], option[1]); err != nil {
+				return err
+			}
+		}
+	}
+	if inside {
+		_, err := r.Output("tmux", "select-window", "-t", first)
+		return err
+	}
+	opts.Hint("toggle broadcast with: netssh sync (or Ctrl+b :setw synchronize-panes)")
+	return r.Exec("tmux", "attach-session", "-t", session)
+}
+
+// freeSession returns name, or name-2, name-3, … if a session already uses it.
+func freeSession(r Runner, name string) string {
+	candidate := name
+	for n := 2; ; n++ {
+		if _, err := r.Output("tmux", "has-session", "-t", "="+candidate); err != nil {
+			return candidate
+		}
+		candidate = name + "-" + strconv.Itoa(n)
+	}
+}