feat(ssh): Optimize SSH performance Phase 1-2c + stdin fix

Phase 1: take_payload() optimization
- cipher.rs: Added take_payload() to EncryptedPacket
- server.rs: Use take_payload() to avoid .to_vec() copy

Phase 2a: reuse_buf for CHANNEL_DATA
- channel.rs: Added reuse_buf to ExecProcess
- handle_channel_data(): Read directly into reuse buffer

Phase 2b: read_buf for stdout/stderr
- channel.rs: Added read_buf to ExecProcess
- poll_exec_stdout_and_client(): Use read_buf for all reads

Phase 2c: AES-GCM padding optimization
- cipher.rs: Removed padding .to_vec() in AES-GCM decrypt

stdin fix: All exec commands use interactive process
- channel.rs: Removed conditional rsync/SCP detection
- All exec commands now use handle_interactive_exec()
- Fixes cat/grep/sed stdin support (small files working)

AES-GCM improvements:
- cipher.rs: Added CipherMode enum (AES-GCM vs AES-CTR)
- cipher.rs: AES-256 key derivation (32 bytes)
- cipher.rs: Nonce format follows OpenSSH inc_iv()
- kex.rs: Added aes256-gcm@openssh.com to algorithms

Performance: ~21% improvement for small files
Test: 158 passed, 0 failed
Limitation: Large files (>10MB) not working yet (poll loop issue)

markbase-core/src/ssh_server/sshbuf.rs

@@ -259,6 +259,19 @@ impl SshBuf {
         // OpenSSH: 保留 Vec，只重置指针
     }
 
+    /// 消费内部 Vec，提取有效数据（零拷贝）
+    /// 相当于 OpenSSH sshbuf_free() 但返回数据
+    pub fn into_vec(mut self) -> Vec<u8> {
+        let len = self.len();
+        if self.off == 0 && self.size == self.data.len() {
+            // 正好是完整 buffer，直接返回
+            self.data
+        } else {
+            // 需要截取有效部分
+            self.data[self.off..self.size].to_vec()
+        }
+    }
+
     /// Debug: 打印 buffer 状态
     pub fn debug_info(&self) -> String {
         format!(