Provider: status and dash work from a laptop over the operator's own SSH

[toon-backlog-bot]

Closes #65

Review

Spec:

• Acceptance (dash --ssh root@<box> shows the same six panes): met for a public box. A hidden box shows the panes, but its Solana balances (and now its EVM gas estimate) say to read them on the box. The README states this deliberately, since a hidden box must not dial public RPCs from the laptop. A human should confirm that is acceptable. Nothing tests dash --ssh automatically; the status --ssh tests cover the shared path.
• Uses the operator's own ssh and its config: met. It runs the ssh on PATH with one master connection and per-connection relays.
• Nothing new exposed on the box: met. Relays run docker compose exec -T provider bash and open /dev/tcp from inside the container.
• Earnings: pick one and document it: met, "over the tunnel". The bearer token is read over SSH and held only in memory.
• Clear errors for "no ssh", "host unreachable" and "provider not running there": met and tested. Classification is by exit code, so authentication and host-key failures (ssh exit 255) are labelled "host unreachable", but they carry ssh's own message.
• Laptop build: met. The README documents cargo install --locked --git https://github.com/toon-protocol/provider toon-provider and says there are no release binaries.
• Builds on Provider bundle: move to the x402-only connector and client 4.x #66 (x402): yes. Earnings come from the x402 channel rows, and r posts /channels/:id/land through the tunnel.

Standards: fixed in 4a1c08d:

• Control directory: it's now created under an unguessable name in /tmp and never reuses or deletes a directory that's already there. Before, it was the predictable /tmp/toon-provider-ssh-<pid>, deleted and recreated.
• ssh master on interrupt: status --ssh and dash --ssh now close the master on Ctrl-C, SIGTERM or SIGHUP. Before, the -f master outlived the process.
• Reading provider.toml: the probe now sends the table headers. chain and token are read in any order and only inside [[settlement]], and the top-level keys only before the first table. A new unit test covers this.
• Bearer token: it's a Secret (whose Debug never prints it) inside Facts as well.
• Hidden box gas estimate: the box's EVM RPC is no longer dialled from the laptop when the box is hidden. The README now says so, and notes that /topup is reachable on the laptop's loopback tunnel.

Left for a human:

• Relay tasks: they aren't tracked by the session. Their ssh children die with the master.
• Flags ignored over --ssh: --connector-operator-url, --bearer-token-file and the *-address-file flags.
• Non-Unix laptops: with no master connection, there is no passphrase prompt.
• Each tunnelled request starts a new ssh plus docker compose exec: refreshes are slow.
• Small smells: the env-var names are repeated, Link and Wiring carry the same fields, and operator_connector_url sits beside operator_url.
• Manual check: the signal handling and the new probe are verified only by unit tests, the existing fake-ssh CLI tests and running the probe's grep against the template. Nobody has tried dash --ssh against a real box.

Gate: cargo fmt, cargo test, cargo clippy — passed.

🤖 Generated with Claude Code