Terminal without an open port: the agent calls back, and the SSH dialog shows its state

Bamboo reports where its SSH server listens. When a terminal is opened,
Hammerhead lists the session in the site's config and the agent connects out and
joins that connection to its SSH server; Hammerhead signs in over it. No port
resource or edge is involved. A site whose Bamboo does not report an SSH server
still works through an SSH port. The long poll now returns at once for a session
the agent has not been told about, so a request between two polls is not missed.

The SSH dialog shows whether the SSH server is running, says when no port is
needed, and offers the port only for an ordinary ssh client. Builds against Reef
v0.1.12 and Bamboo v0.1.9.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -164,13 +164,16 @@ for each provider (e.g. `CF_DNS_API_TOKEN` for `cloudflare`); `.env` is the plac
   same offset (up to 1000 ports per entry; a busy port inside a range is named in the status).
 - TCP, UDP, "TCP + UDP" in one click, HTTP and HTTPS reverse proxy, and TLS passthrough by SNI.
 - **SSH into a site, and a terminal in the dashboard.** Start Bamboo with `-ssh` and list the allowed public
-  keys in its `authorized_keys`. The **SSH** button on the Sites page opens a TCP port on an edge to that
-  server and shows the `ssh` command to use. The same dialog shows Hammerhead's own public key: add it to
-  `authorized_keys` and **Open terminal** gives an administrator a shell in the browser. Hammerhead is the
-  SSH client (it signs in through that SSH port), saves each site's host key the first time and refuses a
-  different one later (with a button to forget it), allows a terminal only from the dashboard's own origin,
-  logs opening and closing in the audit log, and closes an idle one after 30 minutes. The shell runs as the
-  user Bamboo runs as, so treat Hammerhead's key like a root login if Bamboo runs as root.
+  keys in its `authorized_keys`. The **SSH** button on the Sites page shows Hammerhead's own public key: add
+  it to `authorized_keys` and **Open terminal** gives an administrator a shell in the browser. No port has to
+  be open anywhere: Bamboo reports its SSH server, and when a terminal is opened it calls back to Hammerhead
+  and joins that connection to the server. Hammerhead is the SSH client, saves each site's host key the
+  first time and refuses a different one later (with a button to forget it), allows a terminal only from the
+  dashboard's own origin, logs opening and closing in the audit log, and closes an idle one after 30
+  minutes. The shell runs as the user Bamboo runs as, so treat Hammerhead's key like a root login if Bamboo
+  runs as root. To connect from your own computer with an ordinary `ssh` client, the same dialog can open a
+  TCP port on an edge to that server and shows the command to use. An older Bamboo that does not report its
+  SSH server can still be reached through such a port.
 - **PROXY protocol (v1/v2)** on tcp and tls ports: the target is told the real client address, so IP
   bans, rate limits, spam checks and logs see the visitor instead of the tunnel. Your server must be
   set to expect it and to trust only the edge or site: Velocity/BungeeCord `haproxy-protocol`, Postfix