fix(remote-ssh): restore target selection and container stdin

[bobleer]

Summary

• keep every portalled connection-mode Select menu above the raised SSH dialog overlay
• verify configuration assembly for SSH, remote Docker, local Docker, and container sshd targets
• preserve streamed stdin when the Docker command supervisor launches its child asynchronously

Fixes #2175

Type and Areas

Type:

Regression fix / bug fix / UI/UX / test

Areas:

Web UI, Rust remote SSH/container services, desktop/Tauri integration

Motivation / Impact

The connection target menu was rendered into the shared overlay host at z-index 360 while the SSH dialog overlay used z-index 20000, so the menu opened invisibly behind the modal.

A functional review also found that the shared local/remote Docker supervisor lost stdin because POSIX non-interactive shells attach /dev/null to asynchronous fd 0. Duplicating stdin before backgrounding restores interactive container commands.

Users can now select all four connection targets, and supervised Docker commands retain stdin.

Verification

• pnpm --dir src/web-ui run test:run src/features/ssh-remote/SSHConnectionDialog.test.tsx src/features/ssh-remote/SSHRemoteProvider.test.tsx — 18 passed
• pnpm run type-check:web
• pnpm run build:web
• pnpm run prepare:mobile-web
• cargo test -p bitfun-services-integrations --features remote-ssh,remote-ssh-concrete,workspace-search remote_ssh — 141 passed, 1 ignored
• cargo test -p bitfun-services-integrations --features remote-ssh --test remote_ssh_contracts — 9 passed
• cargo test -p bitfun-desktop local_docker_profiles_do_not_require_a_legacy_password_vault_entry -- --nocapture — passed
• real alpine:3.22 Docker round trip via ignored local_docker_workspace_round_trip — passed stdin/stdout/stderr, exit status, cancellation, file operations, and atomic writes
• pnpm run check:build-prereqs
• pnpm run check:repo-hygiene
• git diff --check

Reviewer Notes

AI-assisted, fully tested. The real local Docker transport was exercised against Docker Engine 29.2.1. Remote SSH and remote Docker configuration/transport paths are covered by the focused contract and unit suites; no external SSH host or credentials are required.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.