Harden SSH: disable passwords, forwarding, add keepalive

Add SSH hardening to user_data for future server rebuilds:
- PasswordAuthentication no (key-only access)
- X11Forwarding no (headless server)
- AllowTcpForwarding no (no SSH tunnels needed)
- AllowAgentForwarding no (no agent forwarding needed)
- MaxAuthTries 3 (reduced from 6)
- ClientAliveInterval 300 + ClientAliveCountMax 2 (clean up dead sessions)

Already applied manually to the existing server via
/etc/ssh/sshd_config.d/99-hardening.conf.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/terraform/main.tf

@@ -41,6 +41,18 @@ resource "hcloud_server" "trails" {
 
     # Create app directory
     mkdir -p /opt/trails-cool
+
+    # Harden SSH
+    cat > /etc/ssh/sshd_config.d/99-hardening.conf <<'SSHD'
+    PasswordAuthentication no
+    X11Forwarding no
+    AllowTcpForwarding no
+    AllowAgentForwarding no
+    MaxAuthTries 3
+    ClientAliveInterval 300
+    ClientAliveCountMax 2
+    SSHD
+    systemctl reload ssh
   EOF
 }