feat: add multi-vendor driver framework and Ciena 6500 TL1 model

[stephenstack]

Summary

Adds a pluggable per-device driver framework so the SSH simulator can present multiple vendor personalities, and ships the first non-Cisco model: Ciena 6500 7-slot optical (TL1). Also adds --ssh-auth to model both real-world TL1 access patterns.

Cisco IOS behaviour is preserved byte-for-byte — the existing session loop was extracted verbatim into the cisco_ios driver, with the shared response-delay / fault-injection / metrics machinery factored into helpers both drivers call.

What's new

• Driver framework (internal/sshsrv/driver.go): a per-device personality resolved at session start from the manifest template column (previously written but unused at runtime). New vendors are one self-contained file. Shared across drivers: response-delay jitter, the three stream faults, zero-copy ConfigOutput streaming, and the command_duration / bytes_sent metrics. Driver-owned: greeting/prompt, command read-unit, grammar/dispatch, and SSH-auth requirement.
• Ciena 6500 TL1 (driver_ciena.go, internal/configs/ciena.go): bare < prompt, in-band ACT-USER::<user>:<ctag>::<pass>; login gate (anything before a valid login returns TL1 DENY), and ;-terminated RTRV-* verbs (EQPT, ALM-ALL, COND-ALL, ACTIVE-USER, SW-VER, SYS) returning COMPLD/DENY. RTRV-EQPT::ALL streams a deterministic, generated 7-slot shelf inventory zero-copy via mmap; the other verbs are synthesized at runtime.
• Generator model registry (internal/configs/generator.go): the Cisco size buckets are generalised into a model registry. Select Ciena via --distribution "sm:50,ciena-6500-tl1:50". The manifest vendor/template columns now reflect the per-device model.
• --ssh-auth password|driver|none: models TL1-only access (no SSH challenge; ACT-USER is the only gate) vs SSH login + TL1. Each driver declares RequiresSSHAuth() (Cisco yes, Ciena no); driver mode consults it so mixed Cisco/Ciena fleets behave correctly.
• Docs: new Architecture subsection on the driver model, a Ciena TL1 data-flow, the --ssh-auth flag, and the ciena-6500-tl1 model under Configuration templates.

Compatibility

No breaking changes. No CSV schema change (the vendor/template columns already existed), no renamed flags/buckets/metric label keys, and Cisco generated bytes + wire output are byte-identical. New TL1 command label values are additive and stay within the asserted cardinality bound. Release: v0.0.3 (pre-1.0 patch).

Tests

• Characterization tests pinning the Cisco greeting / enable-mode / session-close before the refactor — the regression gate for the byte-for-byte extraction.
• TL1 unit tests: command parsing, login gate, COMPLD/DENY rendering, unknown-verb handling.
• --ssh-auth mode × driver matrix (unit) plus over-the-wire no-auth tests, including the negative case (a Cisco device rejects a no-auth client under driver mode).
• Integration: ACT-USER login, RTRV-EQPT streaming, pre-login DENY, multi-line command, and the no-auth scenarios.

Gate green: go fmt/vet/build/test ./... and go test -tags integration ./.... Flakiness probe (5× each) clean.

🤖 Generated with Claude Code