The first connection to a host trusts any key without showing its fingerprint #156

Tested against main (894ea12).

What happens

On a first connection, KnownHosts::verify (core/src/known_hosts.rs:115-145) records whatever host key the server presents and accepts it, with no user step. Authentication follows straight away (core/src/connection.rs:304-334). For a password host, that means the password the user just typed into SshPasswordPrompt goes to whoever answered. connect_ssh never shows the user the fingerprint it pinned.

Anyone on the network path when a user first connects to a host they have saved can therefore answer with their own key, for example on hostile Wi-Fi or with spoofed DNS. Clavyn pins it silently and sends the password. The bad pin is then permanent, so the real server later shows up as a "key changed" warning, and the user is nudged to trust the real key away.

With key authentication the attacker can't relay the login to the real server, but they can still impersonate it and collect whatever the user types into the session.

OpenSSH asks before trusting a first-seen key (StrictHostKeyChecking=ask), and prints the fingerprint so it can be compared against one obtained out of band.

Proposal

Treat a first-seen key the way a changed key is already treated (#38):

1. In check_server_key, when there is no entry, hold the presented key instead of pinning it, and fail the connect with a dedicated "unknown host key" error that carries the fingerprint.
2. The pane shows the fingerprint and a Trust and connect action. That action goes through the native host_key_prompt dialog, which prints the real fingerprint and can't be scripted from the webview, then pins the key and reconnects.
3. Optional: a per-host or global setting to keep today's silent trust-on-first-use, for users who connect to many throwaway hosts.

This is a UX change to every first connection, so it needs a decision before an implementation. The plumbing to hold a key, show it and pin it on confirmation already exists for changed keys.

Severity: medium. It needs a network position at the moment of first contact, which is the classic TOFU window, and Clavyn currently doesn't give the user any chance to notice.