refactor: optimize setting view

internal/domain/config.go

@@ -34,13 +34,17 @@ type S3Config struct {
 //   - Host / Port form the destination endpoint. Port defaults to 22 when 0.
 //   - User is the SSH login name.
 //   - AuthMethod selects how the connection authenticates:
-//       "" / "builtin" → password / ssh-agent / ~/.ssh/id_* via the
-//                         in-process golang.org/x/crypto/ssh client.
+//       "password"     → password only, via the in-process Go SSH client.
+//       "key"          → ssh-agent + ~/.ssh/id_* key files (no password),
+//                         via the in-process Go SSH client.
 //       "kerberos"     → delegate to the system /usr/bin/ssh binary so the
 //                         existing Kerberos (GSSAPI) credential cache from
 //                         `kinit` is reused. Native GSSAPI is required here
 //                         because macOS stores tickets in an API: ccache
 //                         that pure-Go SSH libraries cannot read.
+//       "" / "builtin" → legacy combined behaviour (password → agent → key
+//                         files) kept only for backward compatibility with
+//                         configs written before the method was split.
 //   - Password is optional; when empty the implementation falls back to the
 //     local SSH agent or ~/.ssh/id_* keys (i.e. the user is responsible for
 //     having password-less access already configured on this machine).
@@ -70,9 +74,14 @@ type SSHConfig struct {
 
 // SSH authentication method identifiers stored in SSHConfig.AuthMethod.
 const (
-	// SSHAuthBuiltin uses the in-process Go SSH client (password / agent /
-	// key files). This is the zero-value default.
+	// SSHAuthBuiltin is the legacy combined method (password → agent → key
+	// files). Retained for backward compatibility with older config files;
+	// new configs use the explicit methods below.
 	SSHAuthBuiltin = "builtin"
+	// SSHAuthPassword authenticates with the password field only.
+	SSHAuthPassword = "password"
+	// SSHAuthKey authenticates with ssh-agent / ~/.ssh/id_* key files only.
+	SSHAuthKey = "key"
 	// SSHAuthKerberos delegates to the system ssh binary so an existing
 	// Kerberos credential cache (populated by `kinit`) is reused via GSSAPI.
 	SSHAuthKerberos = "kerberos"