fly.io intercepts port 22, so sshd runs on 2222.
added proper sshd config with knot keys integration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

uses official tngl/knot image with custom entrypoint to work around
s6-overlay incompatibility with fly.io's init system.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>