feat: changed host keys can be rejected, accepted once, or accepted and updated

Under the 'ask' policy a changed host key used to be a hard error. The
prompt now shows the stored and received fingerprints and offers Reject,
Accept Once (connect, keep the record) and Accept & Update (replace the
record; audited). Unknown keys gain an Accept Once option too. Strict and
accept-new still refuse changed keys without prompting. Known-host rows
written by the old app are confirmed removable by id (test).

rust/core/tests/sessions.rs

@@ -2,7 +2,7 @@
 
 use nexus_core::models::{Profile, Protocol, SessionState};
 use nexus_core::secrets::{Keychain, Secrets, Vault};
-use nexus_core::sessions::{Event, Manager};
+use nexus_core::sessions::{Event, HostKeyDecision, Manager};
 use nexus_core::storage::Store;
 use std::io::{Read, Write};
 use std::net::TcpListener;
@@ -34,7 +34,7 @@ fn wait<T>(rx: &mpsc::Receiver<Event>, mut f: impl FnMut(&Event) -> Option<T>) -
             return t;
         }
         if let Event::HostKeyVerify { reply, .. } = e {
-            let _ = reply.send(true);
+            let _ = reply.send(HostKeyDecision::AcceptAndSave);
         }
     }
 }