Merge origin/main into claude/spelunk-tunnel

Port forwarding took host schema version 8 first, so the Spelunk route moves to 9 and is written after the forwards. A host may carry both.

tests/DodoSSH.Client.Domain.Tests/HostSecretCodecTests.cs

@@ -18,10 +18,10 @@ public sealed class HostSecretCodecTests
     /// "Full" cannot mean every field: the two authentication bindings are mutually exclusive, so a host may
     /// carry a key or a credential and never both, and neither may sit beside <c>AsksForPassword</c>. This
     /// one carries the credential, because that is the newer of the two, plus a group, a pair of tags, a
-    /// pair of pinned paths and a Spelunk route — which are orthogonal to the binding and are what make this
-    /// host reach the highest schema version a valid host can. The route and the relay are exclusive in the
-    /// same way the bindings are, so this carries the newer of those two as well; the relay's flag has its
-    /// own tests.
+    /// pair of pinned paths, a pair of forwards and a Spelunk route — which are orthogonal to the binding and
+    /// are what make this host reach the highest schema version a valid host can. The route and the relay are
+    /// exclusive in the same way the bindings are, so this carries the newer of those two as well; the relay's
+    /// flag has its own tests.
     /// </remarks>
     [Fact]
     public void AFullHost_RoundTrips()
@@ -40,6 +40,7 @@ public sealed class HostSecretCodecTests
             groupId: Production,
             tags: [Pci, EuWest],
             pinnedPaths: ["/var/www/app", "/var/log"],
+            portForwards: [Postgres, Socks],
             spelunk: ThroughSpelunk());
 
         HostSecretCodec.TryDecode(HostSecretCodec.Encode(host), out var document).ShouldBeTrue();