chore(deps)!: bump russh to 0.62 and migrate channel-open handlers

russh 0.62 reworked the channel-open callback contract. Both
channel_open_session and channel_open_direct_tcpip now receive a
ChannelOpenHandle and return Result<()> instead of Result<bool>:
accepting requires an explicit reply.accept().await, and dropping the
handle sends an automatic AdministrativelyProhibited rejection.

Handler changes in src/tunnel.rs:

- channel_open_session accepts explicitly instead of returning Ok(true)
- channel_open_direct_tcpip accepts after the TCP connect succeeds but
  before spawning the read pump, so no data is written to a channel the
  client has not yet seen accepted
- a failed TCP connect still propagates, and now also drops the handle,
  which rejects the channel instead of leaving the open request unanswered

This bump also pulls the SSH crypto chain from pre-release to stable:
curve25519-dalek 5.0.0-rc.0 -> 5.0.0, ed25519-dalek 3.0.0-rc.0 -> 3.0.0,
elliptic-curve 0.14.0-rc.33 -> 0.14.1, and p256/p384/p521 to 0.14.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: platinummonkey

Cargo.lock

@@ -125,7 +125,7 @@ aes-gcm = { version = "0.11", optional = true }
 # Synthetics tunnel
 tokio-tungstenite = { version = "0.30", features = ["rustls-tls-native-roots"], optional = true }
 yamux = { version = "0.14", optional = true }
-russh = { version = "0.61", optional = true }
+russh = { version = "0.62", optional = true }
 ssh-key = { version = "0.6", features = ["p256", "std"], optional = true }
 futures = { version = "0.3", optional = true }
 tokio-util = { version = "0.7", features = ["compat", "io"], optional = true }