fix: portable 绿色单机版 SSH 连接 + 主机数据 + 打包体积

SSH 连接修复：
- main.cjs 顶部在所有 ssh2 require 之前安装 boringSslDhCompat 补丁
- 5 条 SSH 连接路径统一 legacyAlgorithms 默认值为 true

portable 版主机数据修复：
- main.cjs portable 模式设置 NETCATTY_PORTABLE=1
- preload.cjs 暴露 window.netcatty.isPortable
- useVaultState portable 模式跳过 safeStorage DPAPI 加密的 hosts_v1
- inspection saveVaultHosts handler 补 legacyAlgorithms/tags/os 字段映射

打包体积修复：
- 恢复 electron-builder.config.cjs 原始 40+ 条排除规则
- package.json 加 pend 运行时依赖

electron/main.cjs

@@ -18,6 +18,14 @@ if (process.env.ELECTRON_RUN_AS_NODE) {
   delete process.env.ELECTRON_RUN_AS_NODE;
 }
 
+// BoringSSL DH compatibility shim — MUST be installed before ANY ssh2 require.
+// Multiple bridges (sshBridge, sftpBridge, hostKeyVerifier, privateKeyNormalizer,
+// sshAuthHelper, portForwardingBridge, inspectionExec, systemSshAgent...) each require
+// ssh2 at module load. ssh2 destructes crypto.createDiffieHellmanGroup at load time,
+// so the monkey-patch has to run before even the first ssh2 module load.
+// Installing here (top of main, before any bridge requires) guarantees ordering.
+require("./bridges/boringSslDhCompat.cjs").installBoringSslDhCompat();
+
 // Load crash log bridge early so process-level error handlers can use it
 const crashLogBridge = require("./bridges/crashLogBridge.cjs");
 const {
@@ -267,6 +275,9 @@ const { applyPortableDataDirectory } = require("./portableData.cjs");
 const portableData = applyPortableDataDirectory({ app });
 if (portableData) {
   console.info(`[Main] Portable data directory: ${portableData.dataDirectory}`);
+  // portable 版 safeStorage DPAPI 绑定 userData 路径，解不开 dev 版 LS 加密 blob。
+  // 设置环境变量让 useVaultState 跳过 LS hosts_v1，直接从 inspection-data.json 读明文。
+  process.env.NETCATTY_PORTABLE = "1";
 }
 const appPath = path.join(__dirname, "..");
 const preload = path.join(__dirname, "preload.cjs");