Implemented initial SSH support. Memory pressure too high for HTTPS and

SSH. Dirty commit.

src/ssh_security.h

@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+/* Persistent SSH host identity, separate from the HTTPS certificate key. */
+
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "esp_err.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define SSH_SECURITY_NVS_NAMESPACE "ssh_sec"
+#define SSH_SECURITY_NVS_BLOB_KEY "material"
+#define SSH_SECURITY_PRIVATE_KEY_DER_CAPACITY 256U
+#define SSH_SECURITY_SHA256_LENGTH 32U
+
+#define SSH_SECURITY_KEY_TYPE "ecdsa-sha2-nistp256"
+#define SSH_SECURITY_CURVE_NAME "nistp256"
+
+typedef enum {
+    SSH_SECURITY_LOAD_STORED = 0,
+    SSH_SECURITY_LOAD_GENERATED_MISSING = 1,
+} ssh_security_load_result_t;
+
+typedef struct {
+    uint32_t generation;
+    uint8_t sha256_fingerprint[SSH_SECURITY_SHA256_LENGTH];
+} ssh_security_metadata_t;
+
+/* NVS and secure_random must be ready. Existing malformed material is not replaced. */
+esp_err_t ssh_security_init(ssh_security_load_result_t *load_result);
+
+/* Query with output NULL/capacity zero; the required length is always returned. */
+esp_err_t ssh_security_copy_private_key(uint8_t *output, size_t capacity,
+                                        size_t *output_length);
+esp_err_t ssh_security_get_metadata(ssh_security_metadata_t *metadata);
+
+/* Caller must stop SSH first. Rotation requires valid live material; reset replaces any stored state. */
+esp_err_t ssh_security_rotate(void);
+esp_err_t ssh_security_reset(void);
+
+#ifdef __cplusplus
+}
+#endif