fix(export): make linked identities and keys opt-in (#336)

[kipavy]

Refs #336 (reopened after the reporter's follow-up).

Linked credentials are opt-in

• buildBundle takes { includeRelatedCredentials }, default false. With it off, identities and SSH keys that exported connections reference are no longer pulled in when their types are unchecked. The connections export without those references, and credentials are assigned after import.
• Secrets stored on the connection itself (password, private key, passphrase) still travel with it: they are part of the same object.
• Jump-host and port-forwarding connection cascades are unchanged.
• Export dialog: new "Include linked credentials" checkbox (off by default), shown only for JSON exports with connections when Identities and Keys are not both checked. The footer's "+N identities / keys" text is gone; the checkbox owns that now.
• MCP export uses the default, so narrowing types actually leaves credentials out, as its refusal message already promised.

Invisible unchecked checkboxes

The unchecked border used --t-border-hover, nearly the dialog background. A single @layer base rule in globals.css now styles native input[type=checkbox] and a shared CheckboxBox (src/components/shared/Checkbox.tsx) with a --t-text-muted border. It replaces six hand-rolled copies: import/export dialogs (4), roles panel, share menu, notes preview CSS, plus the unstyled native boxes in the port-forwarding and connection forms. The import/export radio shares the token through .radio-box.

Verification

• tsc --noEmit clean; 390 tests across import-export, members, terminal, snippets, notes, port-forwarding and connections pass. New registry.spec.ts cases cover the opt-in, the default and explicitly checked identities.
• Checked in the running app (headless, isolated e2e server): export dialog off/on, port-forwarding form, roles panel, terminal share menu, and the light theme.