feat: extend certificate pinning to all TLS protocols and add SSH

host-key pinning

internal/core/types.go

@@ -87,6 +87,17 @@ type DownloadRequest struct {
 	Ctx               context.Context
 	SSHKnownHosts     string // path to known_hosts file (SFTP)
 	SSHInsecure       bool   // skip SSH host key verification (SFTP)
+
+	// PinnedCertHash pins a TLS leaf certificate by its SHA-256 hash
+	// (lowercase hex). Applied to every TLS-bearing protocol: HTTPS,
+	// FTPS, Gemini, WebDAVS. Empty disables pinning.
+	PinnedCertHash string
+
+	// PinnedHostKey pins an SSH host key. Accepted formats:
+	//   "SHA256:<base64>"  — OpenSSH fingerprint (ssh-keygen -lf)
+	//   "<hex>"            — raw SHA-256 hex of the key wire format
+	// Applied to SFTP only. Empty disables pinning.
+	PinnedHostKey string
 }
 
 // DownloadResult represents a download result