docs: fix PRD consistency and align all docs with SSH client-only (FR-006)

PRD fixes:
- Remove duplicate 'Installation Behavior' section
- Fix malformed terminology table (missing pipe separator)

Documentation alignment with FR-006:
- README.md: Change SSH/firewall to client-only, no inbound access
- TEST-COVERAGE.md: Remove 'Firewall allows SSH inbound'
- VERIFICATION-REPORT.md: Fix password config docs to match preseed.cfg
- COMPLIANCE.md: Change 'SSH Hardening' to 'SSH Client-Only'

Test enhancements:
- Expand unit tests for encryption, firewall, security hardening
- Add comprehensive coverage for FR-001 through FR-009 requirements

All changes ensure documentation and tests align with PRD.md FR-006
which requires SSH client-only with no server or inbound access.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

docs/VERIFICATION-REPORT.md

@@ -226,10 +226,10 @@ partman-crypto/erase_disks_secure boolean true
 
 **Password Configuration**:
 ```bash
-passwd/user-password password knelfootballtier0secure2026!
-passwd/user-password-again password knelfootballtier0secure2026!
-passwd/root-password password knelfootballtier0secure2026!
-passwd/root-password-again password knelfootballtier0secure2026!
+# Passwords are prompted during installation (not hardcoded)
+# This ensures each installation has unique credentials
+d-i passwd/user-password-crypted string !
+d-i passwd/root-password-crypted string !
 ```
 
 **Package List**:
@@ -243,7 +243,7 @@ d-i pkgsel/include string \
     mousepad \
     zbar-tools \
     nftables \
-    openssh-server \
+    openssh-client \
     cryptsetup \
     cryptsetup-initramfs \
     busybox \