test: add a local Docker test environment for all features

testenv/ starts two real NetBox 4.7 instances (v2 and v1 token), SSH
targets on public, mgmt, and prod networks, a jump host, an IPv6-only
host, a static host, and a client with ssh, sftp, scp, tmux, zellij,
bash, zsh, and fish. A seed script fills NetBox through the REST API.

141 end-to-end checks cover cache and refresh filters, connecting,
all resolver strategies, multiple instances, shortcuts and rewrites,
SSH options and rules, static hosts, sftp/scp incl. IPv6 and jump
hosts, tunnels, local notes and NetBox comments, completion and shell
hooks, the TUI (driven through tmux), the configurator, and uninstall.

Local only: testenv/up.sh, test.sh, shell.sh, down.sh. Not part of
CI/CD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

testenv/targets/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Prepares host keys and the test users, starts a small HTTP server for the
+# tunnel tests (reachable only on the target itself), then runs sshd.
+set -eu
+
+[ -f /etc/ssh/ssh_host_ed25519_key ] || ssh-keygen -q -t ed25519 -N '' -f /etc/ssh/ssh_host_ed25519_key
+
+for user in ops admin; do
+  home="/home/$user"
+  mkdir -p "$home/.ssh"
+  cp /keys/authorized_keys "$home/.ssh/authorized_keys"
+  chown -R "$user:$user" "$home/.ssh"
+  chmod 700 "$home/.ssh"
+  chmod 600 "$home/.ssh/authorized_keys"
+done
+
+mkdir -p /srv/www
+echo "hello from $(hostname)" > /srv/www/index.html
+python3 -m http.server 8081 --bind 127.0.0.1 --directory /srv/www >/dev/null 2>&1 &
+
+exec /usr/sbin/sshd -D -e

testenv/targets/sshd_config

@@ -0,0 +1,18 @@
+# Test targets accept the generated test key only. Port 2222 tests ssh.default_port.
+Port 22
+Port 2222
+ListenAddress 0.0.0.0
+ListenAddress ::
+HostKey /etc/ssh/ssh_host_ed25519_key
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
+AllowTcpForwarding yes
+AllowAgentForwarding yes
+GatewayPorts no
+PermitTunnel no
+X11Forwarding no
+PrintMotd no
+Subsystem sftp /usr/lib/ssh/sftp-server

testenv/targets/target.Dockerfile

@@ -0,0 +1,16 @@
+# SSH target for the netssh test environment: every NetBox host, the bastion,
+# and the static host run this image with a different hostname.
+FROM alpine:3.23
+
+# Alpine locks new accounts with "!"; sshd refuses key logins for locked
+# accounts, so the password field is set to "*" (no password, not locked).
+RUN apk add --no-cache openssh-server openssh-sftp-server python3 \
+ && for user in ops admin; do \
+      adduser -D -s /bin/sh "$user" && sed -i "s/^$user:!/$user:*/" /etc/shadow; \
+    done
+
+COPY testenv/targets/sshd_config /etc/ssh/sshd_config
+COPY testenv/targets/entrypoint.sh /entrypoint.sh
+
+EXPOSE 22 2222
+ENTRYPOINT ["/entrypoint.sh"]