fix: verify gateway TLS certificates in SSH examples - #126

Summary

• Make all three SSH openssl s_client examples fail closed on certificate verification errors.
• Explicitly set SNI and verify the full app-port gateway hostname, preserving the existing routing and SSH configuration.

Verification

• git diff --check and bash -n dev.sh passed.
• Parsed both documented SSH configurations with ssh -G; shell syntax checked all three ProxyCommands after placeholder substitution.
• Temporary local TLS checks against the extracted commands: 9 passed (trusted matching certificate accepted; untrusted certificate and trusted wrong-host certificate rejected before SSH banner delivery). Full hostname SNI verified in every case. OpenSSL 3.5.7.
• Ran ./dev.sh check-all: Docker Compose validation unavailable because this environment lacks the Compose subcommand; shellcheck/yamllint skipped because unavailable. The script also reports existing example security warnings and exits zero despite validation errors.

Only the two README files change. Temporary verification artifacts stay outside the repository. Live CVM connections and LibreSSL were not tested.