ssh: manage fleet ssh config via chezmoi

Pins git.melonbread.xyz (Forgejo) to port 222 with the machine key
only — the forge SSH daemon does not listen on 22. All boxes pushing
to the forge need this stanza; known_hosts/authorized_keys stay
per-machine and unmanaged.

private_dot_ssh/private_config

@@ -0,0 +1,19 @@
+# Fleet config — managed 2026-08-26
+# Jump host
+Host byte.local
+  User melon
+
+# LAN hosts (direct; user rain)
+Host kaiser.local miche.local dayold.local rye.local crouton.local tadbit.local bit.local rorclar.local ggbuttz.local bazzite.local riska.local bopad.local
+  User rain
+
+# External (via byte.local)
+Host melonbread.xyz mail.melonbread.xyz
+  User rain
+  ProxyJump byte.local
+# Git forge (Gitea) — SSH daemon listens on non-standard port 222
+Host git.melonbread.xyz
+  User git
+  Port 222
+  IdentityFile ~/.ssh/id_ed25519
+  IdentitiesOnly yes