fix: reject SFTP connection on host key verification error and panic on SFTP URL rebase

- `check_server_key` now rejects (rather than silently accepting) when
  known_hosts cannot be read or parsed, so a corrupt/unreadable file no
  longer disables host-key verification.
- `UrlBuf::rebase` no longer hits `todo!()` for SFTP URLs; it rebases via
  a typed `UnixPath` base, matching the other URL variants.

yazi-shared/src/url/buf.rs

@@ -167,8 +167,8 @@ impl UrlBuf {
 				Self::Archive { loc: loc.rebase(base), domain: domain.clone() }
 			}
 			Self::Sftp { loc, domain } => {
-				todo!();
-				// Self::Sftp { loc: loc.rebase(base), domain: domain.clone() }
+				let base = typed_path::UnixPath::new(base.as_os_str().as_encoded_bytes());
+				Self::Sftp { loc: loc.rebase(base), domain: domain.clone() }
 			}
 		}
 	}

yazi-vfs/src/provider/sftp/conn.rs

@@ -54,8 +54,8 @@ impl russh::client::Handler for Conn {
 				Ok(false)
 			}
 			Err(e) => {
-				tracing::warn!("Could not verify host key for `{}`: {e}", self.config.host);
-				Ok(true)
+				tracing::error!("Could not verify host key for `{}`: {e}", self.config.host);
+				Ok(false)
 			}
 		}
 	}