fix(ssh-policy): look up policy by gateway-qualified role

[sashyo]

Summary

Committed SSH policies are written under the JWT's gateway-qualified role (ssh:<gatewayId>:<serverId>:<sshUser>, e.g. ssh:Tide-GW:My Server:demo), but the SSH connect path was fetching by the short-form ssh:<user> (e.g. ssh:demo). The lookup either 404'd or returned a stale row from an older code revision, which then failed Sign #2 with "Policy signature could not be verified" because the bytes the ORK saw were never associated with the freshly-committed signature.

What changed

• client/src/lib/sshClient.ts — SSHSignatureRequest gains gatewayId?: string; the DelegatingPublicKeyAlgorithm callback forwards this.options.gatewayId into the signer.
• client/src/lib/tideSsh.ts — both createTideSshSigner and createDynamicTideSshSigner now build the gateway-qualified role and fetch via api.sshPolicies.getByRole(roleId) (existing endpoint with exact lookup). Non-gateway flows (missing gatewayId/serverId) skip policy fetch with a warning instead of crashing.

No server-side changes — the existing GET /api/ssh-policies/committed/:roleId endpoint already does exact role lookup, which is what we need.

Verification via the trace logs from #41

Before this fix:

[PolicyTrace SIGN]   role=ssh:Tide-GW:My Server:demo dtv_sha=793dc9e7…
[PolicyTrace USE]    role=ssh:demo                   dtv_sha=d2946e66…   ← different row
[PolicyTrace ATTACH] role=ssh:demo                   dtv_sha=d2946e66…

After this fix, all three should carry the same role and identical dtv_sha.

Pre-deploy: delete the orphan row

The pre-fix code-path may have left an ssh:<user> row in ssh_policies that no longer corresponds to a real JWT role:

DELETE FROM ssh_policies WHERE role_id NOT LIKE 'ssh:%:%:%';

Test plan

• Deploy keylessh web app
• Delete stale short-form ssh_policies rows (optional cleanup)
• Commit an SSH policy via Admin Approvals — confirm [PolicyTrace SIGN] with gateway-qualified role
• Connect SSH to that server as the relevant user — confirm [PolicyTrace USE] and [PolicyTrace ATTACH] carry the same role and same dtv_sha as SIGN
• SSH session succeeds (no "Policy signature could not be verified")