Implement SSH authorized key management

src/user_database.h

@@ -116,6 +116,16 @@ typedef struct {
     user_database_account_t users[USER_DATABASE_MAX_USERS];
 } user_database_accounts_t;
 esp_err_t user_database_get_accounts(user_database_accounts_t *accounts);
+/* Zero-wait, identity-conditional projection; fingerprints only, no key blobs.
+ * Output is cleared on failure; absent/stale identity returns NOT_FOUND. */
+esp_err_t user_database_get_account_keys(const user_database_account_t *expected,
+                                         user_database_user_snapshot_t *snapshot);
+esp_err_t user_database_add_ssh_key_current(const user_database_account_t *expected,
+    const uint8_t *key_type, size_t key_type_length,
+    const uint8_t *key_blob, size_t key_blob_length, uint8_t *key_index);
+esp_err_t user_database_remove_ssh_key_current(const user_database_account_t *expected,
+                                               uint8_t key_index);
+esp_err_t user_database_clear_ssh_keys_current(const user_database_account_t *expected);
 /* Compare target identity under the mutation lock, before candidate/commit.
  * ESP_ERR_NOT_FOUND means absent or stale; existing account invariants apply. */
 esp_err_t user_database_delete_current(const user_database_account_t *expected);