fix: portable 绿色单机版 SSH 连接 + 主机数据 + 打包体积

SSH 连接修复：
- main.cjs 顶部在所有 ssh2 require 之前安装 boringSslDhCompat 补丁
- 5 条 SSH 连接路径统一 legacyAlgorithms 默认值为 true

portable 版主机数据修复：
- main.cjs portable 模式设置 NETCATTY_PORTABLE=1
- preload.cjs 暴露 window.netcatty.isPortable
- useVaultState portable 模式跳过 safeStorage DPAPI 加密的 hosts_v1
- inspection saveVaultHosts handler 补 legacyAlgorithms/tags/os 字段映射

打包体积修复：
- 恢复 electron-builder.config.cjs 原始 40+ 条排除规则
- package.json 加 pend 运行时依赖

electron/bridges/sshBridge.cjs

@@ -346,7 +346,7 @@ function createSshDiagnosticLogger(enabled) {
 
 function shouldLogSshDebugMessage(msg) {
   if (typeof msg !== "string") return false;
-  return /auth|publickey|keyboard|handshake|kex|newkeys|dh gex/i.test(msg);
+  return /auth|publickey|keyboard|handshake|kex|newkeys|dh gex|Inbound|Outbound/i.test(msg);
 }
 
 function attachSshDebugLogger(connectOpts, logger = log) {
@@ -586,8 +586,14 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
         //   when the leaf's ECDSA skip is applied to it. Treat both as
         //   strictly per-host: an unset hop value uses the hop's default
         //   offer, not the leaf's narrower setting.
+        // Default legacyAlgorithms to true so NetMesh can connect to older
+        // network devices (Huawei, H3C, Cisco, etc.) that only support
+        // legacy KEX algorithms like diffie-hellman-group1-sha1. Modern
+        // devices still negotiate the strongest mutually supported algorithm
+        // first — offering legacy algorithms alongside modern ones does not
+        // weaken security on capable servers.
         algorithms: buildAlgorithms(
-          jump.legacyAlgorithms ?? options.legacyAlgorithms,
+          (jump.legacyAlgorithms ?? options.legacyAlgorithms) !== false,
           {
             skipEcdsaHostKey: jump.skipEcdsaHostKey,
             algorithmOverrides: jump.algorithmOverrides,
@@ -607,7 +613,7 @@ async function connectThroughChain(event, options, jumpHosts, targetHost, target
       logSshAlgorithms("Jump host", connOpts.algorithms, {
         hostname: jump.hostname,
         port: jump.port || 22,
-        legacyAlgorithms: !!(jump.legacyAlgorithms ?? options.legacyAlgorithms),
+        legacyAlgorithms: ((jump.legacyAlgorithms ?? options.legacyAlgorithms) !== false),
         skipEcdsaHostKey: !!jump.skipEcdsaHostKey,
         hasAlgorithmOverrides: !!jump.algorithmOverrides,
       }, sshDiagnosticLogger);