VFS/DataProvider/Config refactoring + SSH public key authentication

Phase 1-6 of refactoring plan:
- VFS abstraction (VfsBackend trait + LocalFs + OpenFlags builder)
- DataProvider trait (SqliteProvider + PgProvider, SFTPGo-compatible)
- Config refactoring (AppConfig unified sections, env overrides)
- SSH handlers (sftp/scp/rsync) migrated to VFS + DataProvider
- SSH public key authentication (Ed25519 signature verification)
- SSH stderr → CHANNEL_EXTENDED_DATA support
- Web auth uses DataProvider instead of direct SQL
- User home directory from provider (per-user isolation)
- PostgreSQL auth provider for SFTPGo compatibility

markbase-core/src/cli/interface/ssh.rs

@@ -6,20 +6,29 @@ pub enum SshCommand {
     Start {
         #[arg(short, long, default_value = "2024")]
         port: u16,
+
+        /// PostgreSQL connection string for SFTPGo-compatible auth (e.g. "host=127.0.0.1 port=5432 dbname=sftpgo user=sftpgo password=sftpgo_pass_2026")
+        #[arg(long)]
+        pg_conn: Option<String>,
     },
 }
 
 pub async fn handle_ssh_command(cmd: SshCommand) -> anyhow::Result<()> {
     match cmd {
-        SshCommand::Start { port } => {
+        SshCommand::Start { port, pg_conn } => {
             println!("=== MarkBase SSH Server (Hand-written Implementation) ===");
             println!("Port: {}", port);
             println!("Implementation: SSH-2.0-MarkBaseSSH_1.0");
             println!("Features: SSH + SFTP + SCP + rsync");
+            if pg_conn.is_some() {
+                println!("Auth Provider: PostgreSQL (SFTPGo-compatible)");
+            } else {
+                println!("Auth Provider: SQLite");
+            }
             println!("Security: ⭐⭐⭐⭐⭐ (RustCrypto authoritative libraries)");
             println!();
-            
-            crate::ssh_server::server::run_ssh_server(Some(port))?;
+
+            crate::ssh_server::server::run_ssh_server(Some(port), pg_conn.as_deref())?;
         }
     }
     Ok(())