feat: add saved SSH keys and terminal workspace tools

README.rst

@@ -66,10 +66,47 @@ You can also provide credentials with environment variables:
 
     WEBSSH_AUTH_USERNAME=admin WEBSSH_AUTH_PASSWORD='strong-password' wssh
 
-Saved connections are stored under the data directory too. WebSSH saves
-hostname, port, username, ssh password and terminal type for quick
-reconnects. It does not persist private keys, key passphrases or TOTP
-codes.
+Saved connections are stored under the data directory too. Connection
+details include hostname, port, username, terminal type, initial directory,
+name, group and notes. Search or filter saved connections by group, and use
+the Save notes button to update metadata without reconnecting.
+
+Saving connection details and saving credentials are separate options.
+Passwords and private keys are encrypted using the server cookie secret
+only when Save password / private key is selected. Saving the private-key
+passphrase requires its own checkbox. Credentials are never returned in
+connection listings, and TOTP codes are never saved. After a successful
+connection with Save connection enabled, deselecting Save credentials
+clears the previously saved credentials for that destination.
+
+Each terminal tab owns a separate SSH session. New connection opens another
+tab; switching or closing a tab does not interrupt other sessions. Reconnect
+starts a new SSH session using saved credentials when available. Encrypted
+keys without a saved passphrase and two-factor connections require fresh
+input. To retain remote processes across disconnects, use tmux on the SSH
+server. Reloading the browser closes its live sessions.
+
+The terminal toolbar provides output search (also Ctrl/Cmd+F), fullscreen,
+font size, themes and cursor settings. Terminal preferences and single-line
+command bookmarks are stored in the current browser. Inserting a bookmark
+does not send Enter; review it and press Enter yourself.
+
+File management uses the active tab's SSH connection and requires SFTP on
+the remote server. Browse directories and upload or download regular files
+up to 16 MiB. Uploads exclusively create a new file and never overwrite an
+existing filename. A failed upload may leave a partial file. One file
+operation at a time is allowed per SSH session; other terminals remain
+usable. HTTP requests are limited to 17 MiB to allow multipart overhead.
+
+Export configuration produces JSON without credentials. Encrypted backup
+includes stored credentials protected by an independent backup password
+(at least 10 characters). Keep this password to restore on another server;
+restored credentials are encrypted using that server's cookie secret.
+Import validates the whole batch before writing, accepts at most 500
+connections and merges by host, port and username under the current user.
+Configuration imports preserve existing credentials; encrypted backup
+imports replace them for matching destinations. Connection imports do not
+change active sessions, browser settings or command bookmarks.
 
 Use ``--auth=false`` only for a trusted private deployment where another
 layer already protects access to WebSSH.