(feature) Add Django-managed SSH credentials

Add SSH credentials as first-class Django data so backup keys can be
uploaded through the control panel instead of mounted into containers.

Credentials can be selected globally or overridden per host. At runtime
the selected key is materialized inside the container with restrictive
file permissions and injected into the rsync SSH command via IdentityFile.
Known hosts entries are handled the same way when configured.

Add control panel views for creating and listing SSH keys, expose the
fields in config forms and admin, document the workflow, and cover global
and host credential selection with tests.

README.md

@@ -139,6 +139,15 @@ POBSYNC_BACKUP_ROOT=/mnt/backups/pobsync docker compose up --build web scheduler
 The Django setup UI keeps the backup root fixed at `/backups`; only the Docker mount decides which host directory
 that points to.
 
+## Django-Managed SSH Keys
+
+SSH keys can be managed from the Django UI at `/ssh-credentials/`. Add a private key there, optionally paste
+`known_hosts` entries, and select the credential either as the global default or as a per-host override.
+
+When a backup starts, the worker writes the selected key to `/opt/pobsync/state/ssh-credentials/<id>/identity`
+inside the container with `0600` permissions and injects `IdentityFile` into the rsync SSH command. If `known_hosts`
+is configured, the worker also writes a matching `known_hosts` file and injects `UserKnownHostsFile`.
+
 ## Docker With MariaDB
 
 ```