A test pins SSH auth refusals: an unknown service, channel traffic before auth, a mismatched key blob and an unknown algorithm #7203

For: every way an unauthenticated peer can misbehave in the auth layer ends closed, and a test proves it.

src/ssh/auth.ts disconnects on a SERVICE_REQUEST for anything other than ssh-userauth or ssh-connection (line 56). It also disconnects on any channel or global request before USERAUTH_SUCCESS (line 74), and on a USERAUTH_REQUEST for a service other than ssh-connection (line 115). It answers FAILURE for a key algorithm outside ACCEPTED_KEY_ALGOS, and for a blob whose algorithm does not match the one named (lines 154-160). None of these is named in a test.

Done:

• [ ] A new test/ssh-auth-refusals.test.ts drives Auth through a fake AuthHost. It covers: a SERVICE_REQUEST for ssh-agent disconnects. GLOBAL_REQUEST and CHANNEL_OPEN before success each disconnect. A USERAUTH_REQUEST for service ssh-foo disconnects. password and none get FAILURE listing only publickey. An algorithm ssh-dss gets FAILURE. An ssh-ed25519 request carrying an RSA blob gets FAILURE.
• [ ] In every case, authorize and succeeded are never called with the bad key, and the session never reaches success.
• [ ] A correctly echoed SERVICE_ACCEPT for ssh-userauth is asserted byte for byte, as RFC 4253 §10 asks.

Files: test/ssh-auth-refusals.test.ts only. Risk: none. Test only.