feat(git-identity): import an existing SSH key and sign commits with it

Settings → Git gains Commit signing: one picker signs every commit
(terminal, Changes panel, agents) with one of the account's keys —
gpg.format ssh, user.signingkey = the key's private file, commit.gpgsign
true in its own ~/.gitconfig; a signing key the user set up themselves is
replaced only after a confirm (EFOREIGNSIGN without `replace`). Import a key
you have takes a key file or paste (OpenSSH or PEM, ed25519 or RSA >= 2048)
into ~/.config/agenthub/ssh/ as a named key, written like a generated one
(member: write-as, 0600), and by default signs with it in the same step.
A passphrase key, a .pub, an ecdsa key, a mismatched paste and the same key
twice are refused; only the public half ever comes back. Deleting the
signing key stops signing so commits keep working.

The SSH tab is renamed "Git (GitHub, GitLab, Gitea, Backlog…)" with the
Gitea and Backlog steps, and the File Explorer's ESECRET toast now says
that top-level dot folders of a home are edited in a terminal, and where
the SSH keys live instead.

server/openapi-extra/files.js

@@ -459,6 +459,45 @@ const paths = {
       responses: { 200: { description: "The identity." } },
     },
   },
+  "/api/me/git/ssh-key/import": {
+    post: {
+      tags: ["Git identity"],
+      summary:
+        "Import a private key the user already has as a named key; with `sign`, sign commits with it at once",
+      operationId: "importSshKey",
+      requestBody: json(
+        {
+          privateKey: { type: "string", description: "The key file's text (OpenSSH or PEM)." },
+          name: { type: "string", pattern: "^[a-z0-9][a-z0-9-]{0,31}$" },
+          sign: { type: "boolean" },
+          replace: { type: "boolean" },
+        },
+        ["privateKey"]
+      ),
+      responses: {
+        201: {
+          description:
+            "The identity, plus `imported` (the key's public half) and `signError` (a refused `sign`, else null).",
+        },
+        400: { description: "EBADKEY / EKEYPASSPHRASE / EBADKEYTYPE / EBADKEYNAME" },
+        409: { description: "EEXISTS (the same key, or the name is taken) / ETOOMANYKEYS" },
+      },
+    },
+  },
+  "/api/me/git/signing": {
+    put: {
+      tags: ["Git identity"],
+      summary:
+        "Sign every commit with one of the account's keys (`key`: its id), or stop (`key: null`)",
+      operationId: "setCommitSigning",
+      requestBody: json({ key: { type: "string", nullable: true }, replace: { type: "boolean" } }),
+      responses: {
+        200: { description: "The identity; `signing.state` is on, off or foreign." },
+        400: { description: "ENOKEY" },
+        409: { description: "EFOREIGNSIGN — ~/.gitconfig already signs with a key of its own." },
+      },
+    },
+  },
   "/api/me/git/ssh-terminal": {
     put: {
       tags: ["Git identity"],