Let a host marked for the relay actually be reached through it

The relay checkbox said it was not wired up, and the plan said the server
half was built and shipped. It was not: there was ADR 0004, the contract
records, RelayOptions and a CHECK constraint, and RelayOptions said in its
own remarks that there was no endpoint and no dialler. So both halves are
built here, as step 3 of docs/reaching-a-host-you-cannot-dial.md.

Server, in Features/Relay:

- POST /api/v1/relay/tickets makes every decision: the host, Connect on
  its vault, the relay switched on, and the stored name resolved once and
  judged by RelayAddressPolicy. Loopback, link-local, 0.0.0.0/8,
  multicast and the metadata endpoints are refused with no configuration
  escape, with IPv4-mapped and NAT64 spellings unwrapped first; then the
  operator's denials, allow-list and private-network switch. What passes
  goes into a Data Protection ticket, and nothing resolves the name again.
  Every target refusal is the same 403, so the endpoint cannot be used to
  map the operator's DNS; the real reason is logged.
- GET /api/v1/relay/connect takes the ticket as a second subprotocol,
  checks its expiry against TimeProvider and spends it with a unique
  insert into relay_ticket_use before accepting the upgrade. After the
  upgrade a refusal is a close code: 4502 for a host the server could not
  reach, 4429 for a limit, 4408 idle, 4409 lifetime, 1001 after a drain.
- relay_session is the audit row, written from short-lived scopes.

Client:

- RelayBridge is a loopback SOCKS5 listener that accepts once and pipes
  to the relay socket. It rides on the new SshLoopbackProxy.Lifetime, so
  the connection disposes it on every way a session ends and a failed
  connect disposes it before throwing.
- ServerRelay, exposed as IVaultServer.Relay from /api/v1/meta, asks for
  the ticket, opens the socket, starts the bridge and turns every refusal
  into a sentence.
- VaultViewModel and TransfersViewModel reach a relayed host through it,
  never fall back to dialling it directly, and replace SSH.NET's transport
  error with the relay's own reason when it gave one.

Neither side ever cancels a WebSocket operation. Cancelling one aborts
the socket, and an aborted socket sends no close frame, which is the only
way the client learns the server could not reach the host.
AnIdleSession_IsClosedWithTheIdleCode asserts that the code arrives.

Three departures from ADR 0004, recorded in it: awaited copy loops rather
than Pipelines (same backpressure, two 32 KiB buffers), no ?ticket=
fallback, and no device id in the ticket.

Tests: API 245, shell 582 (5 skipped), layout 170, SSH 110 including a
real login through the bridge, API client 30, contracts 25. Not run: the
Android build (its change is copy only) and the Alpine layout oracle.

src/DodoSSH.Client.Ssh/SshNetConnectionFactory.cs

@@ -75,12 +75,22 @@ public sealed class SshNetConnectionFactory(IKnownHostStore knownHosts)
     {
         ArgumentNullException.ThrowIfNull(request);
 
-        var client = new SshClient(BuildConnectionInfo(request)) { KeepAliveInterval = KeepAliveInterval };
+        var lifetime = request.Proxy?.Lifetime;
 
-        var gate = await ConnectThroughHostKeyGateAsync(client, request, progress, cancellationToken)
-            .ConfigureAwait(false);
+        try
+        {
+            var client = new SshClient(BuildConnectionInfo(request)) { KeepAliveInterval = KeepAliveInterval };
 
-        return new SshNetConnection(client, gate.Presented!);
+            var gate = await ConnectThroughHostKeyGateAsync(client, request, progress, cancellationToken)
+                .ConfigureAwait(false);
+
+            return new SshNetConnection(client, gate.Presented!, lifetime);
+        }
+        catch
+        {
+            await DisposeAsync(lifetime).ConfigureAwait(false);
+            throw;
+        }
     }
 
     /// <inheritdoc />
@@ -95,6 +105,40 @@ public sealed class SshNetConnectionFactory(IKnownHostStore knownHosts)
     {
         ArgumentNullException.ThrowIfNull(request);
 
+        var lifetime = request.Proxy?.Lifetime;
+
+        try
+        {
+            return await OpenSftpCoreAsync(request, lifetime, cancellationToken).ConfigureAwait(false);
+        }
+        catch
+        {
+            await DisposeAsync(lifetime).ConfigureAwait(false);
+            throw;
+        }
+    }
+
+    /// <summary>
+    /// Disposes a proxy the connection was given, when the connection it was given for did not happen.
+    /// </summary>
+    /// <remarks>
+    /// Every failure path, including the ones before a socket exists — an unreadable key throws from
+    /// <see cref="BuildConnectionInfo"/> — because a relay bridge left listening after a failed connect is a
+    /// loopback SOCKS proxy with an open relay session behind it, and nothing would ever close it.
+    /// </remarks>
+    private static async ValueTask DisposeAsync(IAsyncDisposable? lifetime)
+    {
+        if (lifetime is not null)
+        {
+            await lifetime.DisposeAsync().ConfigureAwait(false);
+        }
+    }
+
+    private async Task<ISftpSession> OpenSftpCoreAsync(
+        SshConnectionRequest request,
+        IAsyncDisposable? lifetime,
+        CancellationToken cancellationToken)
+    {
         // Keep-alive here for the reason it is on the shell client: a transfer connection left open while
         // somebody browses is idle in exactly the same way, and a file listing against a machine that has
         // since rebooted would otherwise wait on a socket nothing will ever answer.
@@ -125,7 +169,7 @@ public sealed class SshNetConnectionFactory(IKnownHostStore knownHosts)
             throw;
         }
 
-        return new SshNetSftpSession(client, gate.Presented!, home);
+        return new SshNetSftpSession(client, gate.Presented!, home, lifetime);
     }
 
     /// <summary>
@@ -326,7 +370,15 @@ public sealed class SshNetConnectionFactory(IKnownHostStore knownHosts)
 }
 
 /// <summary>An SSH.NET-backed connection.</summary>
-internal sealed class SshNetConnection(SshClient client, HostKeyPresentation hostKey) : ISshConnection
+/// <remarks>
+/// Owns the proxy it was reached through when it was given one, and disposes it after the client — the
+/// order that lets SSH.NET close its end of the loopback socket before the thing on the other end goes.
+/// </remarks>
+internal sealed class SshNetConnection(
+    SshClient client,
+    HostKeyPresentation hostKey,
+    IAsyncDisposable? proxyLifetime = null)
+    : ISshConnection
 {
     /// <inheritdoc />
     public bool IsConnected => client.IsConnected;
@@ -366,10 +418,14 @@ internal sealed class SshNetConnection(SshClient client, HostKeyPresentation hos
     }
 
     /// <inheritdoc />
-    public ValueTask DisposeAsync()
+    public async ValueTask DisposeAsync()
     {
         client.Dispose();
-        return ValueTask.CompletedTask;
+
+        if (proxyLifetime is not null)
+        {
+            await proxyLifetime.DisposeAsync().ConfigureAwait(false);
+        }
     }
 }