add ProxyJump function

internal/keymgr/configonly.go

@@ -28,7 +28,7 @@ type ConfigOnlyResult struct {
 // needless key material handed around). The config's IdentityFile line
 // references the same deterministic filename GeneratePair always used
 // (username + "_jump_key"), so it matches the key the user already has.
-func BuildConfigOnlyArchive(scratchDir, outDir, jumpHost string, jumpPort int, username, password string, forwards []model.Forward) (*ConfigOnlyResult, error) {
+func BuildConfigOnlyArchive(scratchDir, outDir, jumpHost string, jumpPort int, username, password string, forwards []model.Forward, proxyJump bool) (*ConfigOnlyResult, error) {
 	userScratch := filepath.Join(scratchDir, username+"_configonly")
 	if err := os.MkdirAll(userScratch, 0o700); err != nil {
 		return nil, fmt.Errorf("create scratch dir: %w", err)
@@ -36,14 +36,21 @@ func BuildConfigOnlyArchive(scratchDir, outDir, jumpHost string, jumpPort int, u
 	defer Wipe(userScratch)
 
 	keyFileName := username + "_jump_key"
-	allocated := AllocateLocalPorts(forwards)
 
-	cfg := RenderClientConfig(jumpHost, jumpPort, username, keyFileName, allocated)
+	var cfg, instr string
+	if proxyJump {
+		cfg = RenderClientConfigProxyJump(jumpHost, jumpPort, username, keyFileName, forwards)
+		instr = RenderConfigUpdateInstructionsProxyJump(username, forwards)
+	} else {
+		allocated := AllocateLocalPorts(forwards)
+		cfg = RenderClientConfig(jumpHost, jumpPort, username, keyFileName, allocated)
+		instr = RenderConfigUpdateInstructions(username, allocated)
+	}
+
 	if err := os.WriteFile(filepath.Join(userScratch, "config"), []byte(cfg), 0o600); err != nil {
 		return nil, fmt.Errorf("write config: %w", err)
 	}
 
-	instr := RenderConfigUpdateInstructions(username, allocated)
 	if err := os.WriteFile(filepath.Join(userScratch, "INSTRUCTIONS.txt"), []byte(instr), 0o600); err != nil {
 		return nil, fmt.Errorf("write instructions: %w", err)
 	}