Implement SSH port forwarding and improve jump host UI

Port Forwarding (new):
- Add PortForward model with local/remote direction, bind/dest addresses
- Implement ForwardManager in sshclient/portforward.go with full
  bidirectional tunnel support for both local and remote forwarding
- Integrate ForwardManager into SSH client lifecycle (auto-start on
  connect, clean shutdown on close)
- Add session manager methods: ListPortForwards, StartPortForward,
  StopPortForward with event emission
- Add API surface: ListPortForwards, StartPortForward, StopPortForward
- Add validation for port-forward rules in ValidateSSHConfig
- Add port forwarding section to profile editor with direction, bind/dest
  host/port, label, and enable toggle
- Add frontend event handling for forward:started/stopped/error
- Style port-forward rows with charcoal card design matching jump hosts

Jump Host UI improvements:
- Add private key path field to jump host editor rows
- Collect privateKeyPath in form value collection
- Restyle jump host rows as two-line cards with clear field grouping

internal/models/models.go

@@ -94,6 +94,7 @@ type SSHConfig struct {
 	KeepaliveCountMax int               `json:"keepaliveCountMax"`
 	Compression       bool              `json:"compression"`
 	JumpHosts         []JumpHost        `json:"jumpHosts"`
+	PortForwards      []PortForward     `json:"portForwards"`
 	StartupCommand    string            `json:"startupCommand"`
 	EnvVars           map[string]string `json:"envVars"`
 }
@@ -108,6 +109,26 @@ type JumpHost struct {
 	PrivateKeyPath string     `json:"privateKeyPath"`
 }
 
+// PortForwardDirection indicates the tunnel direction.
+type PortForwardDirection string
+
+const (
+	PortForwardLocal  PortForwardDirection = "local"
+	PortForwardRemote PortForwardDirection = "remote"
+)
+
+// PortForward defines a single SSH port-forwarding rule.
+type PortForward struct {
+	ID        string               `json:"id"`
+	Direction PortForwardDirection `json:"direction"`
+	BindHost  string               `json:"bindHost"`  // local address to listen on (local) or remote bind (remote)
+	BindPort  int                  `json:"bindPort"`
+	DestHost  string               `json:"destHost"`  // target address to forward to
+	DestPort  int                  `json:"destPort"`
+	Enabled   bool                 `json:"enabled"`   // whether to activate on connect
+	Label     string               `json:"label"`     // optional descriptive label
+}
+
 // TelnetConfig holds Telnet-specific settings for a connection profile.
 type TelnetConfig struct {
 	LocalEcho        bool       `json:"localEcho"`