[AlexMacocian]

Summary

• add a separate bearer-authenticated headless gateway for bounded SSH commands
• require alias allowlists, pinned SSH host keys, and a gateway-owned private key
• add container packaging, tests, and documentation
• upgrade SSH.NET to 2026.0.0 to resolve published high-severity advisories

Validation

• 78 tests passed; 5 opt-in WebDAV tests skipped
• headless project published successfully
• win-x64, linux-x64, osx-x64, and osx-arm64 builds passed locally
• live SSH command, stderr/exit-code, authentication, pinning, and timeout behavior verified
• Android validation intentionally delegated to PR CI