Sem 115 feature perproject configurable proxy definitions ssh socks - #4123

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@api-docs.yml`:
- Around line 2978-2991: Add the missing ObjectReferrers definition to
api-docs.yml, matching the schema expected by the
/project/{project_id}/proxies/{proxy_id}/refs response, and duplicate the same
definition in web/public/swagger/api-docs.yml so both
`#/definitions/ObjectReferrers` references resolve.

In `@db/sql/migrations/v2.20.2.sql`:
- Around line 1-13: Update the project__proxy table definition in migration
v2.20.2 to enforce UNIQUE(project_id, name), then add a regression test covering
creation of two proxies with the same name in one project and asserting the
duplicate is rejected.

In `@services/project/backup.go`:
- Around line 369-379: Update the backup name-normalization flow in
makeUniqueNames to include b.proxies, ensuring each project’s proxy names are
unique before BackupProxy serialization and restore lookup via findEntityByName.
Preserve the existing naming behavior for other entities and ensure the
normalized names are used by BackupProxy.Name.

In `@services/tasks/local_executor_inventory.go`:
- Around line 57-65: Update getInventorySSHCommonArgs to generate a unique SSH
config alias for the proxy jump host containing its HostName, User, Port, and
proxy SSHAgent SocketFile, then use that alias in ProxyJump instead of applying
IdentityAgent to destination options. In
services/tasks/local_executor_inventory.go:57-65 implement the jump-host
configuration; in services/tasks/local_executor_test.go:74-85 add coverage with
a proxy SSH key asserting IdentityAgent is configured on the jump-host alias
rather than only on destination options.

In `@web/src/components/ProxyForm.vue`:
- Around line 47-56: Update the ProxyForm save flow to normalize an empty port
value to null before submitting the request, and ensure zero is rejected by the
port validation rule. Locate the relevant save handler and port field rules in
ProxyForm.vue; preserve valid ports from 1 through 65535 and keep the nullable
API contract intact.

In `@web/src/views/project/Proxies.vue`:
- Around line 57-61: Update the item.host slot template to render a clear
separator between the host text and the conditional port value, while preserving
the existing user@host formatting and omitting the separator when item.port is
absent.

---

Outside diff comments:
In `@db/sql/inventory.go`:
- Around line 45-55: Before persisting ProxyID in both inventory create and
update methods, validate non-nil values by calling GetProxy with
inventory.ProjectID and the dereferenced proxy ID, returning any error before
the write. Preserve nil ProxyID handling, and add create/update tests confirming
proxies from another project are rejected.

---

Nitpick comments:
In `@web/src/views/project/Proxies.vue`:
- Around line 67-76: Gate the edit and delete action controls in the
item.actions slot with the same can(USER_PERMISSIONS.manageProjectResources)
permission check used by the create button. Ensure users lacking this permission
cannot see either action while preserving the existing askDeleteItem and
editItem handlers for authorized users.
- Around line 3-27: Update the EditDialog title and ObjectRefsDialog
object-title in Proxies.vue to use the existing vue-i18n proxy translation keys
instead of the literal “Proxy” and “proxy” strings; add the editProxy key to
en.js if needed and preserve the existing create/edit title behavior.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@db/Proxy.go`:
- Around line 59-61: Update proxy validation around the SSHKeyID check to
resolve the referenced access key using proxy.ProjectID, require it to be an
AccessKeySSH key, and reject missing, cross-project, or mismatched key types
before persistence. Apply this validation to both CreateProxy and UpdateProxy,
and add tests covering valid keys and rejected invalid or cross-project keys.

---

Outside diff comments:
In `@db/Proxy.go`:
- Around line 72-86: Update Proxy.Destination to normalize a single outer
bracket pair from p.Host before calling net.JoinHostPort, so already-bracketed
IPv6 hosts produce exactly one bracket pair with a port. Preserve existing
user-prefix and unported-host behavior, and add a regression test covering a
bracketed IPv6 host with a port.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@web/src/components/ProxyForm.vue`:
- Line 51: Update the port validation in ProxyForm.vue so the ProxyForm port
field rejects fractional values like 22.5 before submission; adjust the rule
attached to the port input to require an integer (or convert the value to an
integer before saving) while still allowing empty/null values and the existing
1–65535 range, and update the port input itself to use type="number" with
step="1" so it matches the nullable integer contract.