feat: netssh multi — several hosts side by side in tmux or zellij

netssh multi opens one pane per host in a tmux window or zellij tab.
Hosts come from names, tag:TAG (NetBox and static hosts), cluster:NAME
(NetBox virtualization clusters; devices by default, --kind vm|all),
and groups from the config (@name, nested, with cycle detection).
Every pane runs netssh HOST, so lookup, rules, and jump hosts apply.

- tmux: a new window inside tmux, else a new session that is attached;
  tiled layout, pane borders with the host and a [SYNC] marker.
- zellij: a generated grid layout; a new tab inside zellij, else a new
  session.
- --sync broadcasts typing to all panes; netssh sync toggles it in the
  current tmux window or zellij tab.
- TUI: Space marks hosts, Ctrl+A marks all, Enter opens them together.
- Configurator: multiplexer, panes per window, groups.

NetBox SearchAll gains a cluster filter (name to cluster IDs per
instance), and cache entries keep the host's cluster for completion
and an offline fallback. Panes skip the 24-hour background refresh
(checked once by multi) and get HOME/XDG paths but no NETSSH_* values,
which would expose tokens in the process list.

testenv/tests/15-multi.sh checks real tmux and zellij sessions,
including a broadcast command arriving on all three cluster nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

testenv/README.md

@@ -78,10 +78,13 @@ ssh always reads `/home/tester/.ssh/config` (OpenSSH ignores `$HOME`): it uses
 the test key, `BatchMode`, `StrictHostKeyChecking accept-new`, and
 `LogLevel ERROR`. Tests that need their own known_hosts set
 `ssh.options.UserKnownHostsFile`. The TUI test runs netssh inside tmux and
-reads the screen with `tmux capture-pane`.
+reads the screen with `tmux capture-pane`. The multi test (`15-multi.sh`)
+opens panes in real tmux and zellij sessions and checks that broadcast typing
+reaches every node.
 
 ## Not covered
 
 - The installer (`install.sh`) downloads release assets from Gitea; it is tested by the Go tests with local fixtures.
 - macOS paths and behaviour.
 - `netssh uninstall` runs only with `--dry-run`, so the client keeps its binary.
+- tmux and zellij run headless inside the client; the checks read their state (`tmux list-panes`, `zellij action dump-layout`) and screen contents, not what a real terminal would render.