Merge origin/main into claude/spelunk-tunnel

Port forwarding took host schema version 8 first, so the Spelunk route moves to 9 and is written after the forwards. A host may carry both.

src/DodoSSH.Client.Sync/ItemKinds.cs

@@ -274,6 +274,8 @@ internal sealed class HostKind : IItemKind<HostSecret>
         Note(changed, "Password prompt", before.AsksForPassword, after.AsksForPassword);
         Note(changed, "Group", before.GroupId, after.GroupId);
         Note(changed, "Tags", before.TagIds, after.TagIds);
+        Note(changed, "Port forwards", before.PortForwards, after.PortForwards);
+        Note(changed, "Pinned paths", before.PinnedPaths, after.PinnedPaths);
 
         return changed;
     }