fix: resolve SSH tunnel failures with config profiles (#672)

[datlechin]

Summary

• Support Include directive in SSH config parser — hosts defined in included files (e.g., ~/.ssh/config.d/*, OrbStack, Lima) now appear in the Config Host picker. Recursive parsing with glob patterns, circular include protection, and depth limiting.
• Fix tunnel cleanup for profile-based connections — cleanup now uses effectiveSSHConfig(profile:) instead of reading inline sshConfig.enabled, preventing port leaks when SSH profiles are used.
• Expand SSH config tokens (%d, %h, %u, %r, %%) in IdentityFile/IdentityAgent paths — previously stored literally, causing "file not found" errors.
• Filter multi-word Host entries — entries like Host prod dev staging are now excluded from the picker to prevent DNS resolution failures.
• Improve SSH handshake error messages — now shows detailed libssh2 error strings instead of numeric codes.
• Log warning when SSH profile lookup fails — helps diagnose silent fallback to inline config.

Closes #672

Test plan

• Verify ~/.ssh/config with Include config.d/* shows hosts from included files in Config Host picker
• Verify SSH Profile-based connections create and clean up tunnels correctly
• Verify IdentityFile %d/.ssh/key resolves to correct path
• Verify multi-word Host prod staging entries don't appear in picker
• Verify SSH handshake failure shows descriptive error message
• Run SSHConfigParserTests and SSHPathUtilitiesTests (26 new test cases)