feat: add private repository support with SSH key and HTTPS token auth

- Generate SSH ed25519 key pair on agent startup for cloning private repos via SSH
- Add GET /api/v1/settings/ssh-public-key endpoint to expose deploy key
- Add auth_token and auth_username fields to TrackedRepository model
- Wire git2 credential callbacks for both SSH and HTTPS authentication
- Validate repository access before saving (test-connect on add)
- Update dashboard add form with optional auth section showing deploy key and token fields
- Show error toast if private repo cannot be accessed

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

compliance-dashboard/src/infrastructure/repositories.rs

@@ -34,19 +34,29 @@ pub async fn add_repository(
     name: String,
     git_url: String,
     default_branch: String,
+    auth_token: Option<String>,
+    auth_username: Option<String>,
 ) -> Result<(), ServerFnError> {
     let state: super::server_state::ServerState =
         dioxus_fullstack::FullstackContext::extract().await?;
     let url = format!("{}/api/v1/repositories", state.agent_api_url);
 
+    let mut body = serde_json::json!({
+        "name": name,
+        "git_url": git_url,
+        "default_branch": default_branch,
+    });
+    if let Some(token) = auth_token.filter(|t| !t.is_empty()) {
+        body["auth_token"] = serde_json::Value::String(token);
+    }
+    if let Some(username) = auth_username.filter(|u| !u.is_empty()) {
+        body["auth_username"] = serde_json::Value::String(username);
+    }
+
     let client = reqwest::Client::new();
     let resp = client
         .post(&url)
-        .json(&serde_json::json!({
-            "name": name,
-            "git_url": git_url,
-            "default_branch": default_branch,
-        }))
+        .json(&body)
         .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
@@ -61,6 +71,32 @@ pub async fn add_repository(
     Ok(())
 }
 
+#[server]
+pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let url = format!("{}/api/v1/settings/ssh-public-key", state.agent_api_url);
+
+    let resp = reqwest::get(&url)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    if !resp.status().is_success() {
+        return Err(ServerFnError::new("SSH key not available".to_string()));
+    }
+
+    let body: serde_json::Value = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    Ok(body
+        .get("public_key")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string())
+}
+
 #[server]
 pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
     let state: super::server_state::ServerState =