fix: enable git-over-ssh cloning for private repo installs

The manager image had git but not openssh-client, so ssh:// clones
failed outright ("cannot run ssh"). Install openssh-client, and mount
an SSH_DIR (key + known_hosts) into the container read-only so private
repos can actually authenticate — confirmed both gaps while deploying
against real private Zenvairo repos.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile

@@ -23,7 +23,7 @@ RUN npm run build --workspace apps/web
 RUN npm run build --workspace apps/server
 
 FROM node:20-slim
-RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+RUN apt-get update && apt-get install -y --no-install-recommends git openssh-client ca-certificates \
   && rm -rf /var/lib/apt/lists/*
 COPY --from=nixpacks /usr/bin/nixpacks /usr/local/bin/nixpacks
 COPY --from=dockercli /usr/local/bin/docker /usr/local/bin/docker