fix: verify SSH host keys, support ssh-agent, fix remote dir walk bugs

- Replace ssh.InsecureIgnoreHostKey() with TOFU verification against
  ~/.ssh/known_hosts (accept-new for unknown hosts, hard reject on a
  changed key) to close a MITM hole on every SFTP connection.
- Actually connect to a running ssh-agent (SSH_AUTH_SOCK) for auth
  instead of only scanning default key files on disk; give a clear
  error when an explicit IdentityFile is passphrase-protected.
- Fix SSHClient.walk()/DirectorySize: the internal filepathSkipDir
  sentinel leaked out as a real error on stat/ReadDir failures instead
  of being swallowed, aborting size calculation on the first
  unreadable subdirectory instead of skipping it.
- Skip symlink-to-directory entries in remote directory copies instead
  of failing the whole transfer trying to Open() them as regular files.
- Consolidate 5 duplicated sudo-aware home-dir lookups into
  internal/homedir, adding a missing os.Geteuid()==0 check before
  trusting SUDO_USER.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/fs/remote/host.go

@@ -11,6 +11,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"vcom/internal/homedir"
 )
 
 // SSHHost represents a single SSH host configuration.
@@ -66,9 +68,9 @@ type HostStore struct {
 
 // NewHostStore creates a new HostStore.
 func NewHostStore() (*HostStore, error) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return nil, fmt.Errorf("home dir: %w", err)
+	home := homedir.Dir()
+	if home == "" {
+		return nil, fmt.Errorf("cannot determine home directory")
 	}
 
 	store := &HostStore{
@@ -77,6 +79,7 @@ func NewHostStore() (*HostStore, error) {
 
 	// Load or create encryption key
 	keyPath := filepath.Join(home, ".config", "vcom", ".hosts-key")
+	var err error
 	store.cipherKey, err = loadOrCreateKey(keyPath)
 	if err != nil {
 		return nil, fmt.Errorf("encryption key: %w", err)