Phase 1: Increase Argon2id to 128 MiB and add SSH agent forwarding

Argon2id:
- Increase memory parameter from 64 MiB to 128 MiB for stronger KDF

SSH Agent:
- Add agent.go with connectAgent(), agentAuthMethod(), requestAgentForwarding()
- Integrate agent auth into buildAuthMethods() (tried first when enabled)
- Set up agent forwarding after PTY allocation when agentForwarding is true
- Track and clean up agent socket connection on session close
- Add AgentAuth and AgentForwarding fields to SSHConfig model
- Add SSH Agent section to profile editor with toggle controls

internal/sshclient/sshclient.go

@@ -31,6 +31,7 @@ type Client struct {
 	ctx       context.Context
 	cancel    context.CancelFunc
 	forwards  *ForwardManager // port forwarding tunnels
+	agentCleanup func()       // closes agent socket connection
 }
 
 // NewClient creates a new SSH client bound to the given profile.
@@ -151,6 +152,16 @@ func (c *Client) connectInternal(
 		return fmt.Errorf("PTY request failed: %w", err)
 	}
 
+	// Set up SSH agent forwarding if requested (must happen before shell start).
+	if sc.AgentForwarding {
+		if fwdErr := requestAgentForwarding(sshConn, session); fwdErr != nil {
+			// Non-fatal — log but don't abort the connection.
+			if c.onError != nil {
+				c.onError(fmt.Errorf("agent forwarding: %w", fwdErr))
+			}
+		}
+	}
+
 	stdinPipe, err := session.StdinPipe()
 	if err != nil {
 		session.Close()
@@ -245,6 +256,7 @@ func (c *Client) Close() error {
 	session := c.session
 	sshClient := c.sshClient
 	fwdMgr := c.forwards
+	agCleanup := c.agentCleanup
 	onClose := c.onClose
 	c.mu.Unlock()
 
@@ -255,6 +267,11 @@ func (c *Client) Close() error {
 		fwdMgr.StopAll()
 	}
 
+	// Close the SSH agent socket connection.
+	if agCleanup != nil {
+		agCleanup()
+	}
+
 	var firstErr error
 	if session != nil {
 		if err := session.Close(); err != nil && firstErr == nil {
@@ -292,6 +309,18 @@ func (c *Client) Forwards() *ForwardManager {
 func (c *Client) buildAuthMethods(sc models.SSHConfig, getPassword func() (string, error), getPassphrase func() (string, error)) ([]ssh.AuthMethod, error) {
 	var methods []ssh.AuthMethod
 
+	// If agent auth is enabled, try to use the local SSH agent first.
+	if sc.AgentAuth {
+		am, cleanup, err := agentAuthMethod()
+		if err == nil {
+			methods = append(methods, am)
+			c.mu.Lock()
+			c.agentCleanup = cleanup
+			c.mu.Unlock()
+		}
+		// Non-fatal — fall through to other auth methods if agent unavailable.
+	}
+
 	authList := sc.AuthMethods
 	if len(authList) == 0 {
 		authList = []string{"publickey", "password", "keyboard-interactive"}