feat(fleet): add opt-in SSH bootstrap and peer suggestions

[devswha]

Easy SSH setup required ChatMux to be installed beforehand and offered no tailnet PC picker. Owners can now select a suggested SSH target and explicitly opt into first installation of a missing Linux x86_64 peer. The installation toggle defaults off.

Bootstrap downloads the canonical installer for the hub's exact stable version, fixes the backend port at 3001, and refuses existing/broken installations. It rechecks absence and atomically claims the managed root before executing the installer. Authentication files are removed before the long operation; failure or timeout does not retry or uninstall remote data. The existing host-key, restricted-key, role, capacity, and pairing checks remain in the enrollment path.

Candidate suggestions use the bounded local Tailscale status probe, expose at most 128 sanitized unique addresses only to the owner, and return Cache-Control: no-store. Shared browser/server contracts validate these fields. CLI lifecycle diagnostics go to stderr so pairing-token stdout stays machine-readable. Network errors clear credentials and produce a closed UI error. Fleet RFC revision 6, installation/recovery guides, the roadmap, and all ten locales document the resulting behavior.

Validation:

• npm run verify completed with exit 0: audit, client/server type checks, Rust checks/tests, 2,375 repository tests, lint, identity gate, and production build.
• Real POSIX shell fixtures exercise pinned installer arguments, environment overrides, existing roots/wrappers/symlinks, changed state during download and at root creation, download failure, and unsupported platforms; no remote installation runs.
• Browser interaction checks and the reproducible UI matrix cover English desktop/mobile and Korean mobile, 15 success/error scenarios, opt-in, candidate pre-fill, credential clearing, and overflow. This uses simulated responses and viewport emulation, not release-grade CUA or a physical phone.
• Reproduce the UI matrix with python3 scripts/cua/ssh-bootstrap-ui.py --base-url http://127.0.0.1:4341 after starting Vite on port 4341. Evidence and scope are in docs/evidence/ssh-bootstrap/.

Screenshots show the production form in the isolated, clearly marked fixture: