fix: SSH key generation silently overwrites an existing key without warning the user

[ooloth]

Why

Auto-answering the overwrite prompt invisibly can destroy an existing SSH key without the user's knowledge, breaking access to any service that uses it.

Current state

features/install/zsh/ssh.zsh line 47 uses ssh-keygen -q … -N '' <<<"$'\n'"y" to silently answer "y" to the overwrite prompt. The user sees only "Generating a new 2048-bit RSA SSH public/private key pair." with no indication that an existing key at the target path will be replaced.

Ideal state

• The script either confirms the target key path with the user before generating and warns that an existing key will be overwritten, or it skips generation if a key already exists and prompts the user to confirm they want to replace it
• The user is never surprised by silent side-effects on their SSH keys

Starting points

• features/install/zsh/ssh.zsh — line 47 contains the silent auto-answer; surrounding lines show the full key generation flow

QA plan

1. Run the SSH install step when a key already exists at the target path — Expect the script warns the user before overwriting and requires explicit confirmation
2. Run the SSH install step when no key exists — Expect generation proceeds normally with no extra prompts

Done when

The script never silently overwrites an existing SSH key — any overwrite requires visible user confirmation.