feat(remote): support SSH ProxyCommand

[RyanXr226]

Summary

• resolve effective OpenSSH ProxyCommand entries through ssh -G for Remote SSH hosts
• run proxy commands as managed stdio transports with OpenSSH token expansion and shell-injection guards
• preserve direct, network-proxy, ProxyJump, authentication, and known-host behavior while tracking proxy process trees
• document the supported %%, %h, %n, %p, and %r substitutions in both guides

Issues

None.

Verification

• go test ./internal/remote/...
• ProxyCommand-focused Remote SSH tests repeated 5 times
• go vet ./benchmarks/... ./cmd/... ./internal/... ./tools/...
• go test . -run '(Remote|SSH)' in desktop/
• Linux amd64 cross-compile of the internal/remote tests
• go run ./tools/repolint on a clean tracked-source snapshot
• documentation-impact and cache-impact PR gates
• frontend production build, typecheck, lint, CSS checks, and bundle budgets
• Wails v2.12.0 Windows amd64 production build
• manual end-to-end connection through an external ProxyCommand transport

Documentation impact

Documentation-impact: updated - documented ProxyCommand transport behavior and supported OpenSSH token substitutions in both guides.

Cache impact

Cache-impact: none - the change only affects Remote SSH host resolution and transport.
Cache-guard: go test ./internal/remote/... plus a manual end-to-end ProxyCommand connection test.