Add typed SSH remote endpoints

docs/configuration.md

@@ -62,13 +62,38 @@ configured editor.
 IronStorage. Both must be present together and cannot contain line breaks or
 angle brackets. The built-in IronStorage identity is used when both are absent.
 
-Git remotes are HTTPS-only. URLs containing user information, passwords,
-queries, or fragments are rejected. `server_id` and `application_id` are opaque
-references used to retrieve credentials from the operating-system secret
-store; duplicate names and duplicate reference pairs are errors.
+HTTPS remote URLs containing user information, passwords, queries, or fragments
+are rejected. `server_id` and `application_id` are opaque
+HTTPS-only references used to retrieve credentials from the operating-system
+secret store; duplicate names and duplicate reference pairs are errors.
 The HTTPS account name is stored inside the protected credential record, not in
 TOML. OpenPGP passphrases are addressed by the resolved primary fingerprint.
 
+SSH remotes use either `ssh://[user@]host[:port]/path` or scp-like
+`[user@]host:path` syntax and omit the HTTPS credential fields:
+
+```toml
+[[git.remotes]]
+name = "origin"
+url = "git@git.example.test:alice/password-store.git"
+```
+
+The typed endpoint model is always available so an SSH remote remains readable
+in configuration even when the binary was built without SSH. Such a build
+returns a typed unsupported-transport error before connection or repository
+mutation. The optional storage `ssh` feature contains `russh` 0.63.1 and Tokio;
+`russh` default features are disabled and the Ring backend plus RSA key support
+are selected explicitly.
+
+For SSH, URI paths are absolute, scp-like paths without a leading slash are
+relative to the remote account, and `~`/`~user` paths retain tilde-expansion
+semantics. Bracketed IPv6 and explicit URI ports are accepted. Host names are
+IDNA-normalized, repository paths may contain Unicode, and usernames are
+restricted to ASCII letters, digits, `.`, `_`, and `-`. Empty paths, control
+bytes, credentials, queries, fragments, ambiguous unbracketed IPv6 or colon
+paths, leading-option paths, local paths, URL rewrites, separate push URLs,
+helper transports, and unknown schemes fail closed.
+
 `clipboard_timeout_seconds` controls the native clipboard presentation lease.
 It defaults to 45 seconds for upstream `pass` compatibility and must be between
 1 and 300 seconds. The CLI remains alive for the lease so Linux can serve its