You rename an SSH key from the terminal's SSH keys screen with `e`, so each key says which machine holds it #8091

Intent: an owner with several keys can tell them apart before removing one — today a key's name is fixed at add time, so remove is a guess.

Done looks like:

• [ ] src/core/keys.ts gains renameKey(db, userId, keyId, name): trimmed, 1–64 printable characters (the same rule addKey applies to a name), only the user's own key; answers false otherwise and changes nothing.
• [ ] The SSH keys screen (src/tui/screens/sshkeys.ts) offers e "rename" on the selected key: a one-line prompt prefilled with the current name; enter saves and the row redraws; esc changes nothing; a refused name is a toast saying what is allowed.
• [ ] The rename is an event on the bus (key.renamed, actor the user, payload the key id — never the key material).
• [ ] Tests: test/ssh-key-rename.test.ts proves own key renamed, another user's key and a bad name refused; a tui test drives e. Each fails without the change.

Files: src/core/keys.ts, src/tui/screens/sshkeys.ts, test/ssh-key-rename.test.ts

Risks: the name is drawn in the terminal and on Settings › SSH keys — it must stay escaped on the page and control characters must be refused, so a name cannot paint the terminal. Settings' rename button can follow as its own issue.

Brief: scout or mason.