VFS/DataProvider/Config refactoring + SSH public key authentication

Phase 1-6 of refactoring plan:
- VFS abstraction (VfsBackend trait + LocalFs + OpenFlags builder)
- DataProvider trait (SqliteProvider + PgProvider, SFTPGo-compatible)
- Config refactoring (AppConfig unified sections, env overrides)
- SSH handlers (sftp/scp/rsync) migrated to VFS + DataProvider
- SSH public key authentication (Ed25519 signature verification)
- SSH stderr → CHANNEL_EXTENDED_DATA support
- Web auth uses DataProvider instead of direct SQL
- User home directory from provider (per-user isolation)
- PostgreSQL auth provider for SFTPGo compatibility

markbase-core/src/server.rs

@@ -13,6 +13,7 @@ use std::sync::{Arc, Mutex};
 
 use crate::audio;
 use crate::auth::{AuthState, LoginRequest};
+use crate::provider::sqlite::SqliteProvider;
 use crate::render;
 use crate::download;
 use crate::archive::{self, ArchiveFormat, ArchiveProcessor, FormatDetector, ArchiveConfig, ProcessorRegistry};
@@ -57,7 +58,10 @@ pub async fn run(port: u16, file: Option<String>) -> anyhow::Result<()> {
         }))),
         labels: Arc::new(Mutex::new(vec![])),
         db_dir: "data/users".to_string(),
-        auth: AuthState::with_sync("data/auth.sqlite"),
+        auth: AuthState::with_provider(Box::new(
+            SqliteProvider::new("data/auth.sqlite")
+                .map_err(|e| anyhow::anyhow!("Failed to init SqliteProvider: {}", e))?
+        )),
         auth_db_path: "data/auth.sqlite".to_string(),
         s3_keys: Arc::new(Mutex::new(load_s3_keys())),
     };