Add SSH endpoint

Stored encrypted in the vault (needs PAIRPOD_VAULT_KEY). For passphrase-protected keys, ssh-agent is safer — it stores nothing.