Add the SSH session layer and the terminal data plane

The throughput harness the plan requires before any UI, plus the SSH
plumbing under it. 94 new tests, no WebView involved.

Credit-based flow control is what makes `yes` survivable. A terminal renders
at 60 Hz at best while a remote produces output as fast as the network
allows, and the difference has to accumulate somewhere or be refused.
Credit is reserved *before* reading, never after: because the pump cannot
read more than the renderer has room for, the coalescing buffer is bounded
by the window rather than by how fast the remote can talk. When credit runs
out the pump stops reading, SSH's own receive window closes, and the remote
sshd blocks -- backpressure to the source with no custom protocol.

Verified by falsification, not just by passing: with the credit gate removed
three tests fail, including the throughput harness's bounded-memory
assertion. Acknowledgements are clamped because they cross into JavaScript,
where a buggy or hostile page could otherwise claim to have rendered a
gigabyte and talk the host into an unbounded read.

Host key trust is enforced by *failing* the connection rather than
prompting inside the handshake. SSH.NET raises verification synchronously,
so consulting the user there would block the handshake on a UI round trip
and deadlock the first time the prompt needed the UI thread. Unknown host
and changed key become distinct exceptions the caller resolves
asynchronously. A mismatch has no retry path at all: a dialog offering to
continue is how users are trained to click through the one warning that
actually indicates interception. A legitimately rebuilt server is handled by
removing the pin in settings, away from the moment of connecting.

The data plane serves the renderer page from the same loopback listener as
the socket, which makes Origin predictable -- always http://127.0.0.1:{port}
-- where a WebView virtual-host mapping would give a different origin per
backend and nothing to validate. The token is substituted at serve time, so
it never touches disk and never appears in a URL. Being clear about what
that buys: not protection from a process running as this user, which can
read our memory anyway, but from a page in the user's browser attempting
WebSocket connections to loopback ports, which is a real and routine thing.

Two bugs the tests caught. The accept loop handled connections serially, so
an upgraded WebSocket parked it inside the receive loop and every later
request went unanswered -- the page's own script among them. The suite hung
rather than failed, which is how I found it. And SHA-1 is unavoidable here:
RFC 6455 mandates it for Sec-WebSocket-Accept, where it authenticates
nothing. Suppressed narrowly with that reasoning; the alternative,
HttpListener.AcceptWebSocketAsync, throws PlatformNotSupportedException off
Windows.

src/DodoSSH.Client.Terminal/TerminalFrame.cs

@@ -0,0 +1,181 @@
+using System.Buffers.Binary;
+
+namespace DodoSSH.Client.Terminal;
+
+/// <summary>Frames the host sends to the renderer.</summary>
+public enum TerminalServerOpcode : byte
+{
+    /// <summary>Not a legal value.</summary>
+    Unspecified = 0,
+
+    /// <summary>Terminal output. Payload is raw bytes for <c>term.write</c>.</summary>
+    Output = 1,
+
+    /// <summary>A session has been created; the renderer should attach a terminal to it.</summary>
+    SessionOpened = 2,
+
+    /// <summary>A session has ended. Payload is a UTF-8 reason for the user.</summary>
+    SessionClosed = 3,
+}
+
+/// <summary>Frames the renderer sends to the host.</summary>
+public enum TerminalClientOpcode : byte
+{
+    /// <summary>Not a legal value.</summary>
+    Unspecified = 0,
+
+    /// <summary>Keystrokes. Payload is raw bytes for the remote.</summary>
+    Input = 1,
+
+    /// <summary>
+    /// Bytes actually rendered. Payload is a big-endian <see cref="uint"/>, returning credit.
+    /// </summary>
+    Acknowledge = 2,
+
+    /// <summary>The terminal was resized. Payload is four big-endian <see cref="ushort"/> values.</summary>
+    Resize = 3,
+}
+
+/// <summary>
+/// The wire format between the host process and the renderer page.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Binary frames over a loopback WebSocket, not the WebView's JavaScript bridge. The official bridge
+/// is UI-thread-bound string evaluation: at 10 MB/s in 4 KiB chunks that is roughly 2,500 script
+/// evaluations per second on the thread that also has to paint, with base64's 33% overhead on top and
+/// — decisively — no backpressure signal at all. A socket gives flow control for free.
+/// </para>
+/// <para>
+/// Every frame carries a session id because one WebView hosts every terminal. A WebView2 instance is
+/// a separate browser process, so one per tab would mean twenty renderer processes and hundreds of
+/// megabytes for a normal working set of tabs.
+/// </para>
+/// <para>
+/// Fixed 5-byte header, big-endian, no length prefix: WebSocket already delimits messages, so adding
+/// our own length would be a second source of truth about where a frame ends.
+/// </para>
+/// </remarks>
+public static class TerminalFrame
+{
+    /// <summary>Opcode plus session id.</summary>
+    public const int HeaderLength = 1 + sizeof(uint);
+
+    /// <summary>Writes a frame into <paramref name="destination"/> and returns its length.</summary>
+    public static int Write(
+        Span<byte> destination,
+        byte opcode,
+        uint sessionId,
+        ReadOnlySpan<byte> payload)
+    {
+        var total = HeaderLength + payload.Length;
+
+        if (destination.Length < total)
+        {
+            throw new ArgumentException(
+                $"Need {total} bytes for the frame, got {destination.Length}.",
+                nameof(destination));
+        }
+
+        destination[0] = opcode;
+        BinaryPrimitives.WriteUInt32BigEndian(destination[1..], sessionId);
+        payload.CopyTo(destination[HeaderLength..]);
+
+        return total;
+    }
+
+    /// <summary>Allocates and writes a frame.</summary>
+    public static byte[] Create(byte opcode, uint sessionId, ReadOnlySpan<byte> payload)
+    {
+        var frame = new byte[HeaderLength + payload.Length];
+        Write(frame, opcode, sessionId, payload);
+
+        return frame;
+    }
+
+    /// <summary>
+    /// Reads a frame's header and payload.
+    /// </summary>
+    /// <remarks>
+    /// Returns false rather than throwing on anything malformed. These frames arrive from a WebView
+    /// page — a different process running code we shipped but do not control at runtime — so a bad
+    /// frame is untrusted input to be dropped, not an exceptional condition.
+    /// </remarks>
+    public static bool TryRead(
+        ReadOnlySpan<byte> frame,
+        out byte opcode,
+        out uint sessionId,
+        out ReadOnlySpan<byte> payload)
+    {
+        opcode = 0;
+        sessionId = 0;
+        payload = default;
+
+        if (frame.Length < HeaderLength)
+        {
+            return false;
+        }
+
+        opcode = frame[0];
+        sessionId = BinaryPrimitives.ReadUInt32BigEndian(frame[1..]);
+        payload = frame[HeaderLength..];
+
+        return true;
+    }
+
+    /// <summary>Reads an <see cref="TerminalClientOpcode.Acknowledge"/> payload.</summary>
+    public static bool TryReadAcknowledgement(ReadOnlySpan<byte> payload, out uint rendered)
+    {
+        rendered = 0;
+
+        if (payload.Length != sizeof(uint))
+        {
+            return false;
+        }
+
+        rendered = BinaryPrimitives.ReadUInt32BigEndian(payload);
+
+        return true;
+    }
+
+    /// <summary>Reads a <see cref="TerminalClientOpcode.Resize"/> payload.</summary>
+    public static bool TryReadResize(ReadOnlySpan<byte> payload, out DodoSSH.Client.Ssh.TerminalSize size)
+    {
+        size = default;
+
+        if (payload.Length != sizeof(ushort) * 4)
+        {
+            return false;
+        }
+
+        size = new DodoSSH.Client.Ssh.TerminalSize(
+            BinaryPrimitives.ReadUInt16BigEndian(payload),
+            BinaryPrimitives.ReadUInt16BigEndian(payload[2..]),
+            BinaryPrimitives.ReadUInt16BigEndian(payload[4..]),
+            BinaryPrimitives.ReadUInt16BigEndian(payload[6..]));
+
+        return true;
+    }
+
+    /// <summary>Writes a <see cref="TerminalClientOpcode.Resize"/> payload. Used by tests and tooling.</summary>
+    public static byte[] CreateResizePayload(DodoSSH.Client.Ssh.TerminalSize size)
+    {
+        var payload = new byte[sizeof(ushort) * 4];
+
+        BinaryPrimitives.WriteUInt16BigEndian(payload, size.Columns);
+        BinaryPrimitives.WriteUInt16BigEndian(payload.AsSpan(2), size.Rows);
+        BinaryPrimitives.WriteUInt16BigEndian(payload.AsSpan(4), size.PixelWidth);
+        BinaryPrimitives.WriteUInt16BigEndian(payload.AsSpan(6), size.PixelHeight);
+
+        return payload;
+    }
+
+    /// <summary>Writes an <see cref="TerminalClientOpcode.Acknowledge"/> payload.</summary>
+    public static byte[] CreateAcknowledgementPayload(uint rendered)
+    {
+        var payload = new byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32BigEndian(payload, rendered);
+
+        return payload;
+    }
+}