Web terminal: open a shell on a site from the dashboard

Hammerhead signs in to the site's Bamboo SSH server through the SSH port an edge
exposes, with a key of its own, and relays the shell to the browser over a
WebSocket (xterm.js, served by Hammerhead). The SSH dialog shows Hammerhead's
public key to add to authorized_keys. Host keys are saved on first use and a
changed one is refused; the terminal opens only from the dashboard's own
origin, is audited, and closes after 30 minutes idle. Errors reach the page as
messages over the socket. An end-to-end test runs a real shell through the
edge, tunnel and Bamboo.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -163,6 +163,14 @@ for each provider (e.g. `CF_DNS_API_TOKEN` for `cloudflare`); `.env` is the plac
 - **Port ranges** for tcp and udp: `2456-2458` opens all three, each sent to the target port plus the
   same offset (up to 1000 ports per entry; a busy port inside a range is named in the status).
 - TCP, UDP, "TCP + UDP" in one click, HTTP and HTTPS reverse proxy, and TLS passthrough by SNI.
+- **SSH into a site, and a terminal in the dashboard.** Start Bamboo with `-ssh` and list the allowed public
+  keys in its `authorized_keys`. The **SSH** button on the Sites page opens a TCP port on an edge to that
+  server and shows the `ssh` command to use. The same dialog shows Hammerhead's own public key: add it to
+  `authorized_keys` and **Open terminal** gives an administrator a shell in the browser. Hammerhead is the
+  SSH client (it signs in through that SSH port), saves each site's host key the first time and refuses a
+  different one later (with a button to forget it), allows a terminal only from the dashboard's own origin,
+  logs opening and closing in the audit log, and closes an idle one after 30 minutes. The shell runs as the
+  user Bamboo runs as, so treat Hammerhead's key like a root login if Bamboo runs as root.
 - **PROXY protocol (v1/v2)** on tcp and tls ports: the target is told the real client address, so IP
   bans, rate limits, spam checks and logs see the visitor instead of the tunnel. Your server must be
   set to expect it and to trust only the edge or site: Velocity/BungeeCord `haproxy-protocol`, Postfix