Adds the public `proxy::jump` submodule:

JumpHost (struct):
- pub fields: host: String, port: u16, user: Option<String>,
  identity_files: Vec<PathBuf>.
- The chain manager (M13.4) populates identity_files by re-running
  ssh_config::resolve against each hop's name; M13.3 leaves it empty.

parse_jump_chain(raw: &str) -> Result<Vec<JumpHost>, AnvilError>:
- Accepts the OpenSSH `-J` / `ProxyJump` syntax: `[user@]host[:port]`
  comma-separated, whitespace-around-commas tolerated.
- Defaults the port to 22, leaves user as None when omitted.
- Rejects empty strings, trailing/double commas, empty user prefix,
  empty host, invalid port, and the literal `none` (case-insensitive)
  with clear actionable error messages.

MAX_JUMP_HOPS = 8:
- Matches OpenSSH's READCONF_MAX_DEPTH for ProxyJump chains (FR-57).
- Enforced at parse time, not chain-construction time, so callers
  bail out before any network I/O.

IPv6 literals (`[::1]:22`) are not in scope for M13 — none of the
listed FRs require them and the OpenSSH convention is rare in
ProxyJump strings; documented as a follow-up.

Tests: +16 unit tests (single-hop bare, single-hop user@host:port,
two-hop chain, whitespace tolerance, empty-string/whitespace-only,
trailing/double commas, empty user, empty host, invalid port,
out-of-range port, none literal in three case variants, max-length
chain accepted, length+1 chain rejected, struct PartialEq+Clone
sanity). 189 lib tests green, 0 failures.

Plan: M13.3 of let-us-plan-on-bright-cosmos.md. Stacked on M13.2 (PR
#7).