feat: desktop connect-to-server over SSH tunnel (issue #26, phase 5)

specs/server.allium

@@ -25,6 +25,7 @@ surface ServerRuntimeSurface {
     provides:
         ApplicationStarted(mode)
         SshClientConnected()
+        GuiConnectRequested()
 }
 
 rule ModeResolution {
@@ -53,6 +54,15 @@ rule ServerBoot {
         -- host key generated and authorized_keys touched on first boot only
 }
 
+rule GuiRemoteConnection {
+    when: GuiConnectRequested()
+    -- Desktop "Connect to Server…": ssh connect with the same public keys
+    -- (client identity + known_hosts in the private ssh dir), then an OTP
+    -- TCP/IP tunnel to the server's loopback endpoint; the webview loads
+    -- the local tunnel end. Disconnect returns to the local shell URL.
+    ensures: WebviewTunneledToServer()
+}
+
 rule TuiSession {
     when: SshClientConnected()
     -- Each SSH client gets its own TUI app instance on the server;