Credential disclosure via host ID authorization bypass

Missing authorization in Termix before 2.3.2 allows remote authenticated users to disclose stored SSH credentials via terminal WebSocket requests. In src/backend/ssh/host-resolver.ts, resolveHostById selects a host by attacker-supplied host ID without checking ownership or access, and can fall back to decrypting the owner's credential; src/backend/ssh/terminal.ts then pairs that victim credential with attacker-controlled connection fields. Exploitation requires valid low-privilege access and a victim data key that is unlocked in the backend process, after which stored passwords or private-key material can be sent to an attacker-controlled SSH server.