feat(security): add SSH hardening role

Port Modules/Security/secharden-ssh.sh.

Deploys:
- Authorized keys for root, localuser, subodev (conditional on existence)
- Hardened /etc/ssh/sshd_config (skipped on dev workstations)
- ssh-audit hardening drop-in for algorithm restrictions (skipped on
  Ubuntu where it breaks openssh-server)
- Lockdown of sshd_config.d directory permissions

SSH service is validated (sshd -t) before restart.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

roles/security_ssh/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Validate and restart sshd
+  ansible.builtin.command: sshd -t
+  changed_when: false
+  notify: Restart sshd
+
+- name: Restart sshd
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted