add SSH-based host path browser for volume mounts with shared backend SSH routing

[hololee]

Summary

This PR adds host filesystem browsing for volume mounts in Provisioning, improves SSH connection consistency across backend routes,
and unifies modal overlay rendering for UI consistency.

It includes:

• New backend API to browse host directories over SSH with safety limits
• Shared host-SSH utility reuse in terminal/tmux paths
• Provisioning volume mount UX upgrade with manual input + browse modal
• Key-auth browse flow support (local encrypted key + passphrase decrypt)
• Improved error taxonomy and localized copy for browse/auth cases
• Overlay portal refactor for consistent modal backdrop/stacking behavior

Why

• Users needed a safer, easier way to select host mount paths than manual typing only.
• SSH connection logic was duplicated across terminal-related paths.
• Modal backdrop behavior was inconsistent in some screens.

Changes

Backend

• Added router: POST /api/filesystem/host/list
  • File: backend/app/routers/filesystem.py
  • Request: { path?: string, privateKey?: string }
  • Response:
    • success: { status, path, parent, entries[], truncated }
    • error: { status, code, message }
  • Safety/behavior:
    • path normalization
    • shell quoting via shlex.quote
    • timeout on SSH exec
    • entry cap (MAX_HOST_FS_ENTRIES=500)
    • deterministic sorting
    • zsh nonomatch guard
    • directory-only listing (files excluded)
• Registered filesystem router in app:
  • backend/app/main.py
• Refactored terminal/tmux host SSH usage to shared utility:
  • backend/app/routers/terminal.py
• Added/updated backend tests:
  • backend/tests/test_filesystem_router.py
  • backend/tests/test_ssh_host.py
  • backend/tests/test_terminal_tmux_regression.py

Frontend

• Added host path browse modal:
  • frontend/src/components/HostPathPickerModal.tsx
  • Features:
    • current path
    • parent navigation
    • directory click navigation
    • select current directory
    • loading overlay
    • truncated warning
    • error code to user-facing message mapping
• Provisioning integration:
  • frontend/src/pages/Provisioning.tsx
  • Volume row now supports:
    • manual host path input (existing behavior)
    • browse button (new)
  • Added two-step precheck before opening modal:
    • SSH settings check
    • live API probe
  • Key-auth flow:
    • reads encrypted key from localStorage
    • asks passphrase
    • decrypts key locally
    • passes privateKey to browse API
  • Row-level actionable errors with optional “Go to Settings” CTA
  • Fixed precheck parity with backend default SSH port behavior (port optional in precheck)
• Added shared overlay portal and migrated modal usages for consistency:
  • frontend/src/components/OverlayPortal.tsx
  • Applied in:
    • frontend/src/components/Modal.tsx
    • frontend/src/pages/Dashboard.tsx
    • frontend/src/pages/Provisioning.tsx
    • frontend/src/pages/Settings.tsx
    • frontend/src/pages/Templates.tsx

i18n / Docs

• Added browse/auth/error localization keys (en/ko):
  • frontend/src/i18n/locales/en/common.ts
  • frontend/src/i18n/locales/ko/common.ts
• Updated docs:
  • README.md
  • INSTRUCTIONS.md

API Notes

POST /api/filesystem/host/list

• Codes:
  • ssh_not_configured
  • ssh_auth_failed
  • ssh_host_key_failed
  • path_not_found
  • permission_denied
  • browse_failed
• truncated=true when entries exceed 500.

Validation / QA

Executed:

• PYTHONPATH=backend pytest -q backend/tests → passed (36 passed)
• npm --prefix frontend run lint → passed
• npm --prefix frontend run build → passed
• docker compose up --build -d → completed

Manual checks:

• Browse button opens modal when SSH config is valid
• Key-auth only setup works (passphrase prompt + browse)
• Directory navigation/selection works
• Error mapping shown per row with proper CTA behavior
• Truncated message appears when list is capped
• Modal backdrop renders consistently across pages

Risk / Follow-up

• Frontend bundle size warning still exists (pre-existing): consider code-splitting later.
• Optional enhancement: pagination/cursor for very large directories beyond current capped list.