feat: extend certificate pinning to all TLS protocols and add SSH

host-key pinning

internal/protocol/ftp/ftp_test.go

@@ -380,3 +380,21 @@ func TestNewClientTLSConfig(t *testing.T) {
 		t.Errorf("tlsConfig.InsecureSkipVerify should be false by default")
 	}
 }
+
+func TestSetPinnedCert(t *testing.T) {
+	client, err := NewClient("ftps://secure.example.com/file.txt", 30*time.Second)
+	if err != nil {
+		t.Fatalf("NewClient() returned error: %v", err)
+	}
+
+	// Pinning is off by default.
+	if client.pinnedCertHash != "" {
+		t.Errorf("pinnedCertHash should default to empty, got %q", client.pinnedCertHash)
+	}
+
+	// SetPinnedCert normalises to lowercase and trims whitespace.
+	client.SetPinnedCert("  ABCDEF0123456789  ")
+	if client.pinnedCertHash != "abcdef0123456789" {
+		t.Errorf("pinnedCertHash = %q, want %q", client.pinnedCertHash, "abcdef0123456789")
+	}
+}