feat(vnc): add typed ssh transport to saved connections

[seven332]

Summary

• add a strict direct/SSH transport discriminator to saved VNC connections, with same-owner SSH references and restrictive deletion
• persist optional X.509 certificate server identity while preserving the legacy direct-response shape
• fail closed for SSH-backed VNC rows in the current Runner resolve path before KMS, pending the separate tunnel-composition slice
• add generated migrations, owner/Runner route coverage, migration invariant coverage, and rollout/rollback documentation

Explicit exclusions

• does not compose or execute an SSH tunnel in the Runner; that remains tracked by feat: execute vnc sessions through verified ssh transport #35892
• does not expose the new transport or certificate-identity controls in the UI
• does not enable the VNC feature switch

Validation

• pnpm -F @okouai/api-contracts check-types
• pnpm -F @okouai/db check-types
• pnpm -F api check-types:gateways && pnpm -F api check-types:core && pnpm -F api check-types:tests
• pnpm -F @okouai/api-contracts lint
• pnpm -F @okouai/db lint
• API oxlint/type-aware oxlint and ESLint on the changed implementation and tests
• pnpm -F @okouai/api-contracts generate:rust
• runtime API schema comparison against runtime-api-schema-prod (0 findings)
• DATABASE_URL=... pnpm -F api exec vitest run src/signals/routes/__tests__/vnc-configuration.test.ts src/signals/routes/__tests__/ssh-connections.test.ts src/signals/routes/__tests__/runner-vnc.test.ts (39 tests)
• DATABASE_URL=... pnpm -F @okouai/db test:vnc-configuration
• DATABASE_URL=... pnpm -F @okouai/db exec tsx scripts/test-migration-consistency-schema.ts

Closes #35891

Parent context: #35043

[github-actions]

API preview: https://pr-35910-api.vm6.ai

[seven332]

Code Review: PR #35910

Reviewed head: 4af8054684b607ebbbaf452b4e825344b04b233a

Summary

Adds a typed direct/SSH route to saved VNC connections, an independent X.509 server identity, same-owner restrictive SSH references, and current-Runner fail-closed handling before KMS. Generated migrations, production owner/Runner route coverage, and rollout documentation cover the new persisted boundary.

Findings

No findings.

Testing

Focused contract/database/API lint and type checks passed. The three affected API route files passed together (39 tests), VNC migration replay and full migration/schema consistency passed, generated Rust bindings remained stable, and the online runtime API schema comparison reported zero findings. Repository-wide Vitest was not run per repository guidance; PR CI remains the broader verification boundary.

Verdict

LGTM