[Initiative] Implement Git-over-SSH Protocol in gitstore-api

[juliuskrah]

Summary

Implement Git-over-SSH protocol support inside gitstore-api so clients can clone, fetch, and push using ssh://git@<host>/<repo>. All low-level repository operations are delegated to gitstore-git-service via gRPC (#65), keeping gitstore-api as the single network-facing entry point for Git traffic.

Scope

In Scope

• Implement an SSH server within gitstore-api that handles Git's SSH channel protocol (git-upload-pack, git-receive-pack).
• Delegate repository operations to gitstore-git-service over the gRPC contract from [Initiative] Decouple API from Git Storage via gRPC Git Service #65.
• Configurable SSH listen address and port via environment variables.
• Host key loading from environment or filesystem.
• Authentication and authorisation hooks for SSH public keys (initial implementation: accept configured keys or bypass for development).
• Integration tests for git clone, git fetch, and git push over SSH.
• Update Compose configuration and documentation for SSH setup and usage.

Out of Scope

• Building a full SSH key management portal.
• Replacing the existing HTTP smart protocol support.
• Implementing SFTP or other SSH subsystems.
• Certificate-based SSH authentication (public key only in this iteration).

Acceptance Criteria

• A Git client can clone a repository over SSH against gitstore-api.
• git fetch and git push over SSH work with expected auth behavior.
• SSH service startup fails fast with a clear error if host key configuration is missing or invalid.
• CI includes SSH transport coverage for clone, fetch, and push happy-path operations.
• Compose and documentation include SSH port setup and a quick-start example.

Dependencies

• Blocked by: [Initiative] Decouple API from Git Storage via gRPC Git Service #65

Tracking

• Milestone: TBD

[juliuskrah]

Follow-up from #70 (Repository Storage Identity)

Feature #010 (branch 010-repo-storage-identity) defines the lookup contract that this initiative depends on. Before implementing the SSH server in gitstore-api, the following must be in place from #70:

• NamespaceMapping store is queryable from gitstore-api — the (namespace_id, repo-name) → repo_id lookup must be available before the SSH channel can resolve inbound repository paths.
• gRPC call contract carries repo_id only — the gRPC interface ([Initiative] Decouple API from Git Storage via gRPC Git Service #65) must accept a pre-resolved repo_id so the SSH handler can pass it after lookup, with no namespace string crossing the service boundary.
• "Repository not found" error contract defined — the SSH layer must translate a lookup-level not-found into a clean SSH channel close with an appropriate error message, not a filesystem-level failure.

The SSH handler will follow the same resolve (in gitstore-api) → delegate via gRPC (to gitstore-git-service) pattern as the HTTP Smart HTTP handler (#103). Both are blocked on #70 landing the storage identity contract.