Let a connection be reached through a proxy on this machine's loopback

Step 1 of docs/reaching-a-host-you-cannot-dial.md, and it is not the step that document said it was.

SshConnectionRequest carries an optional SshLoopbackProxy and BuildConnectionInfo hands SSH.NET its proxy
ConnectionInfo when there is one. Nothing passes one yet: the callers are jump hosts and the relay, which
are steps 2 and 3.

◆ THE BRIDGE WAS THE WRONG FIRST STEP, AND BUILDING IT WOULD HAVE BEEN THE MISTAKE THIS DOCUMENT IS ABOUT.
ADR 0004 says the relay's loopback bridge "also provides ProxyJump via a SOCKS5 dynamic forward — one
mechanism, two features", and the plan took that to mean the bridge was the shared foundation. It is not:
ForwardedPortDynamic *is* the listener for a jump host — SSH.NET accepts on it, speaks SOCKS5 on it and
tunnels through the bastion — so nothing is left for a bridge of ours to do on that path. The relay is the
case with no SshClient to hang a forward off, so it is the bridge's only consumer, and the bridge belongs in
the commit that uses it. What the two actually share is one level down and a tenth of the size: being told
to reach a target through a loopback proxy while staying about the target. That is what this is.

Three properties, one test each.

A port and nothing else, so a proxy anywhere but loopback cannot be expressed. The failure that shape rules
out is an open SOCKS proxy on the user's network for the life of a shell, which nothing would report — so it
is made unrepresentable rather than validated, on the same grounds AuthenticationChoice carries a kind.

SOCKS5 rather than a dumb pipe, which is what keeps host key pinning honest. The target's own name and port
stay in the request, travel to the proxy in the CONNECT, and are what the gate pins — so a machine reached
through a bastion is pinned under its own name instead of under 127.0.0.1 on whatever ephemeral port that
day's forward got, which is not an identity at all. A pipe would have meant handing SSH.NET a stand-in and
remembering everywhere else that it was one.

And a proxy that is not listening fails as a connection error rather than as an unknown host key. The gate
turns "no host key seen" into a fingerprint prompt, and a connection that never reached a server has seen
none either; the prompt would offer to fix the wrong thing, with no fingerprint to show.

TWO THINGS THE TESTS MEASURED RATHER THAN ASSUMED, both found by the first run failing.

The target is resolved at the *bastion*, not here — a SOCKS CONNECT names it and the far end looks it up. So
the test asks for localhost:2222, the address inside the container, and the published port this host would
use means nothing there. That is not a quirk of the fixture; it is what ProxyJump means, and it is why an
ssh_config writes the target's internal address beside its jump host. Getting it wrong is a SOCKS "general
failure" that names neither end.

And the test server refuses forwarding. linuxserver/openssh-server ships AllowTcpForwarding no, which a
dynamic forward does not notice — opening one asks the server nothing — so every connection through it is
refused at channel-open and reported as the same general failure. The fixture patches it and HUPs sshd.
There are two sshd_config files in that image and the running server uses /config/sshd/sshd_config; the
first attempt patched /etc/ssh/sshd_config, which is the one a search finds first, changed the text and
nothing else, and left the failure exactly where it was.

VERIFIED. Build clean with no new warnings, 85 tests in Client.Ssh.Tests against the real sshd, and the
solution builds. The proxy test was seen to fail — proxy.Port + 1 in BuildConnectionInfo — and seen green
again. An earlier mutation attempt did not compile, and the log said 85 passing because the run never
started and the previous log was still on disk; the second attempt deletes the log first, which is worth
copying whenever a mutation "passes".

dotnet format reports one pre-existing IDE1006 in DodoSSH.Api/Features/Events/EventsEndpoint.cs, in a
project nothing here touches. Left alone.

tests/DodoSSH.Client.Ssh.Tests/SshServerFixture.cs

@@ -27,6 +27,17 @@ public sealed class SshServerFixture : IAsyncLifetime
     /// <summary>Password for password authentication.</summary>
     public const string Password = "correct-horse-battery-staple";
 
+    /// <summary>
+    /// The port sshd listens on <em>inside</em> the container, rather than the one it is published on.
+    /// </summary>
+    /// <remarks>
+    /// What anything reaching this server from within the container's own network namespace has to use —
+    /// which includes a forward opened on a connection to it. <see cref="Port"/> is the mapped port on the
+    /// host and is not listening in there. See <c>LoopbackProxyTests</c>, where the difference is the whole
+    /// shape of the test.
+    /// </remarks>
+    public const int InternalPort = SshPort;
+
     private const int SshPort = 2222;
 
     private readonly SemaphoreSlim sftpGate = new(1, 1);
@@ -69,6 +80,53 @@ public sealed class SshServerFixture : IAsyncLifetime
             .Build();
 
         await container.StartAsync();
+        await AllowTcpForwardingAsync();
+    }
+
+    /// <summary>
+    /// Lets this server open the direct-tcpip channels a forward is made of.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// ◆ <b>The image ships <c>AllowTcpForwarding no</c>, and nothing says so at the point it bites.</b> A
+    /// dynamic forward starts perfectly happily — it is a local listener, and opening it asks the server
+    /// nothing — and then every connection through it is refused when the channel is opened. SSH.NET
+    /// reports that as <c>SOCKS5: General failure</c> from the proxy, which names neither the server nor
+    /// the setting, and is what the first run of <c>LoopbackProxyTests</c> collected.
+    /// </para>
+    /// <para>
+    /// Patched after start rather than baked in, because the image's entrypoint writes its configuration
+    /// itself on every boot — a mounted file would be overwritten before sshd read it. sshd re-reads on
+    /// <c>SIGHUP</c> and applies the result to connections made after that, and the readiness wait has
+    /// already run, so nothing here races the boot.
+    /// </para>
+    /// <para>
+    /// ◆ <b><c>/config/sshd/sshd_config</c>, and there are two.</b> The image also carries
+    /// <c>/etc/ssh/sshd_config</c>, which looks like the file to patch, reads identically, and is not the
+    /// one the running server was started with — patching it changes the text and nothing else, which is a
+    /// fix that appears to work and leaves the failure exactly where it was. Measured with <c>find</c>
+    /// rather than assumed, after the first version of this method did precisely that.
+    /// </para>
+    /// <para>
+    /// It is on for the whole assembly rather than for the one test that needs it. Forwarding is off in
+    /// this image as hardening, not as a behaviour worth reproducing: nothing else here opens a channel of
+    /// any kind, so allowing it changes what exactly one suite can do and what none of the others see.
+    /// </para>
+    /// </remarks>
+    private async Task AllowTcpForwardingAsync()
+    {
+        var result = await container!.ExecAsync([
+            "sh",
+            "-c",
+            "sed -i 's/^AllowTcpForwarding no/AllowTcpForwarding yes/' /config/sshd/sshd_config"
+                + " && pkill -HUP sshd",
+        ]);
+
+        if (result.ExitCode != 0)
+        {
+            throw new InvalidOperationException(
+                $"Could not enable TCP forwarding on the test server: {result.Stderr}");
+        }
     }
 
     /// <summary>