feat: sync active providers to SSH remotes

[hezhexi2002]

Summary

• add opt-in SSH synchronization for the active provider, with automatic sync after a provider switch and an explicit Sync now action
• preserve unrelated remote Codex project, plugin, MCP, and feature configuration while replacing only provider routing and authentication
• support both official ChatGPT login profiles and Responses-compatible API profiles
• stop a managed remote app-server after a successful switch so Codex can reconnect with the new provider

Security and recovery

• require non-interactive OpenSSH authentication and validate the SSH target and remote CODEX_HOME
• send config.toml and auth.json only through SSH standard input; credentials are never placed in command-line arguments or local staging files
• stage remote files with 0600 permissions, back up the previous files under the remote CODEX_HOME, and roll back both files if apply or app-server shutdown fails
• keep the feature disabled by default and surface a trusted-host warning in the UI and documentation

Validation

• cargo test -p codex-plus-core remote_relay_sync --lib (6 passed)
• cargo check -p codex-plus-manager
• cargo clippy -p codex-plus-core -p codex-plus-manager --all-targets (passed with existing warnings)
• npm run check
• npm run vite:build
• node --experimental-strip-types --test "src/*.test.ts" (47 passed)
• changed Rust files pass rustfmt --check; git diff --check passes
• live macOS-to-Linux SSH validation confirmed provider routing, 0600 permissions, backup creation, preserved remote configuration, and managed app-server shutdown/reconnect behavior

Existing test-suite issues observed locally

• the full workspace run completed with 201 passed and 11 failures in existing proxy, VLM mock, and shared-path tests; the new remote-sync tests all passed
• the repository's exact npm test command does not enable Node's TypeScript stripping on Node 22.17, while the equivalent command above passes all 47 tests
• the i18n verifier reports pre-existing missing/stale DreamSkin, Sub2API, and provider-index entries; no missing entry belongs to this change