add ProxyJump function

internal/model/types.go

@@ -82,10 +82,19 @@ type User struct {
 	// this user was handed a config (full export or config-only update). If
 	// it no longer matches the live computation, their local ssh config is
 	// stale — see IsConfigStale.
-	ForwardsHash string     `yaml:"forwards_hash,omitempty"`
-	Comment      string     `yaml:"comment,omitempty"`
-	CreatedAt    time.Time  `yaml:"created_at"`
-	LockedAt     *time.Time `yaml:"locked_at,omitempty"`
+	ForwardsHash string `yaml:"forwards_hash,omitempty"`
+	Comment      string `yaml:"comment,omitempty"`
+	// ProxyJump selects the client config style delivered to this user: when
+	// true, each allowed service gets its own "Host <alias>" ssh_config block
+	// proxied through "jump" via ProxyJump (plain "ssh <alias>"); when false
+	// (the default, preserving existing state.yaml behavior), the client
+	// config instead lists one LocalForward per service on a single always-open
+	// "jump" connection. Purely a client-config/instructions choice — the
+	// server-side authorized_keys permitopen= restriction is identical either
+	// way (see internal/sysadm/authorizedkeys.go).
+	ProxyJump bool       `yaml:"proxy_jump,omitempty"`
+	CreatedAt time.Time  `yaml:"created_at"`
+	LockedAt  *time.Time `yaml:"locked_at,omitempty"`
 }
 
 // State is the full persisted configuration of the tool.