feat: saved SSH hosts per user, the way in sealed with AES-GCM under a server key kept beside the database

internal/proto/proto.go

@@ -33,6 +33,9 @@ type SSHTarget struct {
 	Password   string `json:"password,omitempty"`
 	Key        string `json:"key,omitempty"`
 	Passphrase string `json:"passphrase,omitempty"`
+	// Saved: a host the user saved on the server; it fills the rest there and
+	// never reaches an agent.
+	Saved int64 `json:"saved,omitempty"`
 }
 
 // EnrollRequest is sent once by a freshly installed agent.