Let a connection be reached through a proxy on this machine's loopback

Step 1 of docs/reaching-a-host-you-cannot-dial.md, and it is not the step that document said it was.

SshConnectionRequest carries an optional SshLoopbackProxy and BuildConnectionInfo hands SSH.NET its proxy
ConnectionInfo when there is one. Nothing passes one yet: the callers are jump hosts and the relay, which
are steps 2 and 3.

◆ THE BRIDGE WAS THE WRONG FIRST STEP, AND BUILDING IT WOULD HAVE BEEN THE MISTAKE THIS DOCUMENT IS ABOUT.
ADR 0004 says the relay's loopback bridge "also provides ProxyJump via a SOCKS5 dynamic forward — one
mechanism, two features", and the plan took that to mean the bridge was the shared foundation. It is not:
ForwardedPortDynamic *is* the listener for a jump host — SSH.NET accepts on it, speaks SOCKS5 on it and
tunnels through the bastion — so nothing is left for a bridge of ours to do on that path. The relay is the
case with no SshClient to hang a forward off, so it is the bridge's only consumer, and the bridge belongs in
the commit that uses it. What the two actually share is one level down and a tenth of the size: being told
to reach a target through a loopback proxy while staying about the target. That is what this is.

Three properties, one test each.

A port and nothing else, so a proxy anywhere but loopback cannot be expressed. The failure that shape rules
out is an open SOCKS proxy on the user's network for the life of a shell, which nothing would report — so it
is made unrepresentable rather than validated, on the same grounds AuthenticationChoice carries a kind.

SOCKS5 rather than a dumb pipe, which is what keeps host key pinning honest. The target's own name and port
stay in the request, travel to the proxy in the CONNECT, and are what the gate pins — so a machine reached
through a bastion is pinned under its own name instead of under 127.0.0.1 on whatever ephemeral port that
day's forward got, which is not an identity at all. A pipe would have meant handing SSH.NET a stand-in and
remembering everywhere else that it was one.

And a proxy that is not listening fails as a connection error rather than as an unknown host key. The gate
turns "no host key seen" into a fingerprint prompt, and a connection that never reached a server has seen
none either; the prompt would offer to fix the wrong thing, with no fingerprint to show.

TWO THINGS THE TESTS MEASURED RATHER THAN ASSUMED, both found by the first run failing.

The target is resolved at the *bastion*, not here — a SOCKS CONNECT names it and the far end looks it up. So
the test asks for localhost:2222, the address inside the container, and the published port this host would
use means nothing there. That is not a quirk of the fixture; it is what ProxyJump means, and it is why an
ssh_config writes the target's internal address beside its jump host. Getting it wrong is a SOCKS "general
failure" that names neither end.

And the test server refuses forwarding. linuxserver/openssh-server ships AllowTcpForwarding no, which a
dynamic forward does not notice — opening one asks the server nothing — so every connection through it is
refused at channel-open and reported as the same general failure. The fixture patches it and HUPs sshd.
There are two sshd_config files in that image and the running server uses /config/sshd/sshd_config; the
first attempt patched /etc/ssh/sshd_config, which is the one a search finds first, changed the text and
nothing else, and left the failure exactly where it was.

VERIFIED. Build clean with no new warnings, 85 tests in Client.Ssh.Tests against the real sshd, and the
solution builds. The proxy test was seen to fail — proxy.Port + 1 in BuildConnectionInfo — and seen green
again. An earlier mutation attempt did not compile, and the log said 85 passing because the run never
started and the previous log was still on disk; the second attempt deletes the log first, which is worth
copying whenever a mutation "passes".

dotnet format reports one pre-existing IDE1006 in DodoSSH.Api/Features/Events/EventsEndpoint.cs, in a
project nothing here touches. Left alone.

src/DodoSSH.Client.Ssh/SshConnection.cs

@@ -16,18 +16,55 @@ public sealed record SshPasswordCredential(string Password) : SshCredential;
 /// <param name="Passphrase">Passphrase protecting the key, when it has one.</param>
 public sealed record SshPrivateKeyCredential(byte[] PrivateKeyPem, string? Passphrase) : SshCredential;
 
+/// <summary>
+/// A SOCKS5 proxy on this machine's loopback interface, through which a host is reached.
+/// </summary>
+/// <param name="Port">The port it is listening on.</param>
+/// <remarks>
+/// <para>
+/// ◆ <b>A port and nothing else, so a proxy anywhere but loopback cannot be expressed.</b> Both things
+/// that will produce one of these listen on <c>127.0.0.1</c> — SSH.NET's own dynamic forward over a
+/// bastion, and the bridge that will front the server relay — and a SOCKS proxy bound to any other
+/// interface is an open proxy into whatever network the machine is on, for as long as the shell is up.
+/// Leaving the host out of this type is what makes that unrepresentable rather than merely unlikely; it is
+/// the same reason <c>AuthenticationChoice</c> carries a kind beside its id.
+/// </para>
+/// <para>
+/// <b>SOCKS5 rather than a plain pipe, and that is what keeps host key pinning honest.</b> The target's
+/// real name and port stay in <see cref="SshConnectionRequest.Host"/> and <see cref="SshConnectionRequest.Port"/>
+/// and travel to the proxy in the CONNECT request, so the connection is *about* the target throughout —
+/// nothing downstream has to be told that the address dialled is not the address being spoken to. A dumb
+/// pipe would have meant handing SSH.NET <c>127.0.0.1</c> and remembering, everywhere else, that it was a
+/// stand-in. See the gate in <c>SshNetConnectionFactory</c>, which pins what this request names.
+/// </para>
+/// <para>
+/// Nothing in this assembly opens one. The proxy is somebody else's — a forward on a bastion connection,
+/// or the relay bridge — and its lifetime belongs to whoever opened it, which must outlast the connection
+/// made through it. See <c>docs/reaching-a-host-you-cannot-dial.md</c>.
+/// </para>
+/// </remarks>
+public sealed record SshLoopbackProxy(int Port);
+
 /// <summary>Everything needed to reach one host.</summary>
 /// <param name="Host">Hostname or address.</param>
 /// <param name="Port">Port.</param>
 /// <param name="Username">Remote account.</param>
 /// <param name="Credential">How to authenticate.</param>
 /// <param name="ConnectTimeout">How long to wait for the transport and handshake.</param>
+/// <param name="Proxy">
+/// A loopback SOCKS5 proxy to reach <paramref name="Host"/> through, or null to dial it directly.
+/// <para>
+/// Last and optional, so that every existing caller — which is every connection this product makes today —
+/// keeps meaning exactly what it did. A host that can be dialled is still dialled.
+/// </para>
+/// </param>
 public sealed record SshConnectionRequest(
     string Host,
     int Port,
     string Username,
     SshCredential Credential,
-    TimeSpan? ConnectTimeout = null);
+    TimeSpan? ConnectTimeout = null,
+    SshLoopbackProxy? Proxy = null);
 
 /// <summary>An interactive shell over a pseudo-terminal.</summary>
 public interface ISshShellSession : IAsyncDisposable

src/DodoSSH.Client.Ssh/SshNetConnectionFactory.cs

@@ -29,6 +29,16 @@ public sealed class SshNetConnectionFactory(IKnownHostStore knownHosts)
     /// </remarks>
     private const uint SftpBufferSize = 64 * 1024;
 
+    /// <summary>Where a <see cref="SshLoopbackProxy"/> is, and the only address one is ever dialled at.</summary>
+    /// <remarks>
+    /// The literal rather than <c>IPAddress.Loopback.ToString()</c>, and rather than "localhost": SSH.NET
+    /// takes the proxy host as a string and resolves it, so a name would put a DNS lookup — and whatever
+    /// the machine's hosts file says <c>localhost</c> means — inside the connect path of every proxied
+    /// connection. It is also the half of the loopback promise this assembly can keep on its own; the other
+    /// half is that the proxy bound there, which is the caller's to get right.
+    /// </remarks>
+    private const string LoopbackAddress = "127.0.0.1";
+
     /// <inheritdoc />
     public async Task<ISshConnection> ConnectAsync(
         SshConnectionRequest request,
@@ -189,9 +199,23 @@ public sealed class SshNetConnectionFactory(IKnownHostStore knownHosts)
     }
 
     /// <remarks>
+    /// <para>
     /// The known-host lookup inside the synchronous event is the one place this design cannot avoid
     /// blocking. It is a local store read rather than a UI round trip, and the alternative — making
     /// the store synchronous — would rule out the encrypted vault-backed implementation entirely.
+    /// </para>
+    /// <para>
+    /// ◆ <b>A proxied connection differs here and nowhere else.</b> The host, the port, the account and the
+    /// credential are the target's either way, and so is everything the gate above reads — which is what
+    /// makes a host reached through a bastion or a relay get pinned under its own name rather than under
+    /// <c>127.0.0.1</c>. The proxy is a route, not a destination, and this is the one method that needs to
+    /// know the difference. See <see cref="SshLoopbackProxy"/>.
+    /// </para>
+    /// <para>
+    /// <c>Timeout</c> is assigned after the branch rather than in two initialisers, because it covers the
+    /// whole of getting there — the proxy handshake included — and having it stated once is what stops the
+    /// two paths quietly drifting to different waits.
+    /// </para>
     /// </remarks>
     private static ConnectionInfo BuildConnectionInfo(SshConnectionRequest request)
     {
@@ -208,10 +232,27 @@ public sealed class SshNetConnectionFactory(IKnownHostStore knownHosts)
                 $"Credential type {request.Credential.GetType().Name} is not supported."),
         };
 
-        return new ConnectionInfo(request.Host, request.Port, request.Username, method)
-        {
-            Timeout = request.ConnectTimeout ?? DefaultConnectTimeout,
-        };
+        var info = request.Proxy is { } proxy
+            ? new ConnectionInfo(
+                request.Host,
+                request.Port,
+                request.Username,
+                ProxyTypes.Socks5,
+                LoopbackAddress,
+                proxy.Port,
+
+                // No proxy credentials, and empty rather than null: SSH.NET offers username/password
+                // authentication to a SOCKS5 server only when it has been given one, and both proxies this
+                // client will ever use are on its own loopback interface, where a password would be a
+                // secret shared between two halves of the same process.
+                string.Empty,
+                string.Empty,
+                method)
+            : new ConnectionInfo(request.Host, request.Port, request.Username, method);
+
+        info.Timeout = request.ConnectTimeout ?? DefaultConnectTimeout;
+
+        return info;
     }
 
     private static PrivateKeyFile CreatePrivateKeyFile(SshPrivateKeyCredential credential)