Add SSH Host alias management (base wizard, standalone service, docs)

Lets 'ssh <alias>' connect directly to user@host instead of retyping it —
especially useful once machines are reachable over NetBird/VPN and have
IPs that aren't worth memorizing.

- lib/common.sh: ssh_config_path/add_ssh_host_alias/list_ssh_host_aliases/
  remove_ssh_host_alias helpers, operating on the invoking user's own
  ~/.ssh/config (not root's) with correct 700/600 permissions and ownership
- base.sh: after SSH key import, optionally add one or more Host aliases
  interactively as part of the base install
- services/ssh-config.sh: new standalone service (sudo ./setup.sh ssh-config)
  to list/add/remove aliases any time, independent of base install; follows
  the existing non-Docker standalone-bootstrap pattern (see crowdsec.sh)
- setup.sh: ssh-config never shows [installed] since it's a repeatable
  management tool, not a one-time install
- README: new 'SSH Host aliases' section, base row and wizard-flow step 1
  updated, ssh-config added to the extras group and copiable service list

Verified end-to-end with a test harness: add with defaults, add with a
custom user/port, list (correct numbering), and remove-by-name preserving
the other entry and file permissions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LQJBvqzXeyuhhAcAA3Q5Wq

services/base.sh

@@ -15,6 +15,7 @@ install_base() {
         echo "[DRY-RUN] Would offer SSH key import from GitHub/Launchpad"
         echo "[DRY-RUN] Would offer to disable SSH password auth"
         echo "[DRY-RUN] Would offer NetBird install with --allow-server-ssh"
+        echo "[DRY-RUN] Would offer to add SSH Host aliases to ~/.ssh/config"
         return 0
     fi
 
@@ -38,6 +39,9 @@ install_base() {
 
     # ── NetBird ──────────────────────────────────────────────────────────────
     _base_setup_netbird
+
+    # ── SSH Host aliases ─────────────────────────────────────────────────────
+    _base_setup_ssh_aliases
 }
 
 _base_setup_ssh() {
@@ -124,6 +128,28 @@ _base_setup_netbird() {
     fi
 }
 
+_base_setup_ssh_aliases() {
+    local ADD_ALIAS=""
+    prompt_yn "Add an SSH Host alias now ('ssh myserver' instead of 'ssh user@1.2.3.4')? (y/n):" "n" ADD_ALIAS
+    [[ "$ADD_ALIAS" =~ ^[Yy]$ ]] || return 0
+
+    while true; do
+        local ALIAS_NAME="" ALIAS_HOST="" ALIAS_USER="" ALIAS_PORT=""
+        prompt_text "  Alias name (e.g. myserver):" "" ALIAS_NAME
+        if [ -z "$ALIAS_NAME" ]; then
+            log_warning "Alias name required — skipping."
+        else
+            prompt_text "  Hostname or IP to connect to (e.g. a NetBird peer IP):" "" ALIAS_HOST
+            prompt_text "  Remote username:" "$ACTUAL_USER" ALIAS_USER
+            prompt_text "  Port [22]:" "22" ALIAS_PORT
+            add_ssh_host_alias "$ALIAS_NAME" "$ALIAS_HOST" "$ALIAS_USER" "$ALIAS_PORT"
+        fi
+        local ADD_ANOTHER=""
+        prompt_yn "  Add another alias? (y/n):" "n" ADD_ANOTHER
+        [[ "$ADD_ANOTHER" =~ ^[Yy]$ ]] || break
+    done
+}
+
 # glow is also exposed as its own module so it can be (re)installed on its own.
 install_glow() {
     if command -v glow >/dev/null 2>&1; then