Add SSH-managed node registry with connection testing and reauth.

Register hosts under Containers/VMs/Docker with encrypted key storage, and require re-authentication for sensitive account changes.

service/internal/auth/session.go

@@ -66,11 +66,12 @@ func (manager *SessionManager) CreateSession(
 	}
 
 	record := settings.SessionRecord{
-		ID:         sessionID,
-		UserID:     userID,
-		CreatedAt:  now,
-		LastSeenAt: now,
-		ExpiresAt:  now.Add(lifetime),
+		ID:           sessionID,
+		UserID:       userID,
+		CreatedAt:    now,
+		LastSeenAt:   now,
+		LastReauthAt: now,
+		ExpiresAt:    now.Add(lifetime),
 	}
 	filtered = append(filtered, record)
 	store.Sessions = filtered
@@ -142,6 +143,7 @@ func (manager *SessionManager) LookupValidSession(
 		}
 		found.ID = newID
 		found.CreatedAt = now
+		// LastReauthAt is preserved across rotation.
 		setSessionCookie(writer, newID, int(found.ExpiresAt.Sub(now).Seconds()))
 	}
 
@@ -153,6 +155,32 @@ func (manager *SessionManager) LookupValidSession(
 	return *found, nil
 }
 
+// MarkReauth updates LastReauthAt for the session identified by sessionID.
+func (manager *SessionManager) MarkReauth(sessionID string) error {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+
+	store, err := settings.LoadSessionsOrEmpty(manager.configDir, manager.key)
+	if err != nil {
+		return err
+	}
+
+	now := time.Now().UTC()
+	found := false
+	for index := range store.Sessions {
+		if store.Sessions[index].ID != sessionID {
+			continue
+		}
+		store.Sessions[index].LastReauthAt = now
+		found = true
+		break
+	}
+	if !found {
+		return ErrSessionNotFound
+	}
+	return settings.SaveSessions(manager.configDir, store, manager.key)
+}
+
 // InvalidateUserSessions removes all persisted sessions for the given user ID.
 func (manager *SessionManager) InvalidateUserSessions(userID string) error {
 	manager.mu.Lock()