docs: fix PRD consistency and align all docs with SSH client-only (FR-006)

PRD fixes:
- Remove duplicate 'Installation Behavior' section
- Fix malformed terminology table (missing pipe separator)

Documentation alignment with FR-006:
- README.md: Change SSH/firewall to client-only, no inbound access
- TEST-COVERAGE.md: Remove 'Firewall allows SSH inbound'
- VERIFICATION-REPORT.md: Fix password config docs to match preseed.cfg
- COMPLIANCE.md: Change 'SSH Hardening' to 'SSH Client-Only'

Test enhancements:
- Expand unit tests for encryption, firewall, security hardening
- Add comprehensive coverage for FR-001 through FR-009 requirements

All changes ensure documentation and tests align with PRD.md FR-006
which requires SSH client-only with no server or inbound access.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

docs/SDLC.md

@@ -29,6 +29,16 @@ This document defines the mandatory Software Development Lifecycle (SDLC) for th
 - Automated + manual review
 - Build-time + runtime validation
 
+### 4. Documentation-Code-Test Synchronization (MANDATORY)
+- **All three must be in sync at ALL times**
+- Documentation = PRD requirements + implementation docs
+- Code = Actual implementation in src/ and config/
+- Tests = Verification that code matches documentation
+- **NO STUB TESTS ALLOWED** - Every test must verify actual behavior
+- When changing code: update tests AND documentation
+- When changing documentation: update code AND tests
+- When changing tests: verify code matches AND update documentation if needed
+
 ---
 
 ## Test-Driven Development (TDD) Workflow
@@ -150,11 +160,11 @@ This document defines the mandatory Software Development Lifecycle (SDLC) for th
 
 2. **Function Documentation**
    ```bash
-   # Function: configure_ssh
-   # Purpose: Configure SSH server with security hardening
-   # Requirements: PRD FR-006 (Key-Based Authentication Only)
-   # Security: Disables password auth per NIST guidelines
-   configure_ssh() {
+   # Function: configure_ssh_client
+   # Purpose: Configure SSH client for outbound connections only
+   # Requirements: PRD FR-006 (SSH Client - No inbound services)
+   # Security: Client-only, hardened cipher suite
+   configure_ssh_client() {
    ```
 
 ---