refactor: behaviour-preserving /simplify pass over src/

[blackaxgit]

What

This runs Claude Code's /simplify over every module in src/ssh_mcp/, with one change set per slice of files so no two edited the same file. A finding was applied only if it keeps behaviour exactly the same and has clear value: dead code, redundant checks, needless indirection, or a comment that just restates the line beside it. The rest were rejected. Result: 6 files, +63 / −131. Tests, public signatures, MCP tool docstrings and every security invariant in AGENTS.md are untouched.

File	Change
config.py	Replaced the if "groups"/"servers" in … guards with .get(…, {}) and dedented. Membership now checks the dicts directly instead of copied key sets. Simpler circular jump-host loop, with the same error text.
formatting.py	Dropped the redundant if s.groups guards, since ", ".join(()) is already "". The footer is one expression. failed = len(results) - succeeded replaces a second counter.
healthcheck.py	Removed an import ssh_mcp probe that can never fail inside ssh_mcp.healthcheck. return e.code < 500, … replaces an if/return/return.
server.py	Removed two read-only global _ssh declarations and two redundant local imports. The identical ToolError/CancelledError re-raise clauses are merged, and a dict comprehension builds the group counts.
ssh.py	A walrus handles the working-dir prefix. Removed a one-use semaphore alias and an offset counter that duplicated written. return await directly. The eviction scan is a list comprehension, with an unused idle_time removed.
pyproject.toml	Comment only: a line-number reference into healthcheck.py now names _check_http.

Models were left alone because nothing there qualified. So was paths.py, which is security-critical, and the rejected findings are listed with reasons in each worker's report.

Verification

• HYPOTHESIS_PROFILE=ci pytest: 848 passed. ruff format and check, mypy, bandit and gitleaks are clean.
• Equivalence scripts compared the old code with the new, byte for byte:
  • jump-host cycle detection over 59,787 graphs, including self-loops, ''/None values, undefined hosts and every dict order;
  • cd command composition, 60 cases;
  • the table and summary formatters, 979 cases;
  • download read offsets, including failure paths;
  • the eviction candidate list, including the exact timeout boundary.
• Smoke: list_groups and list_servers over HTTP (valid, empty and unknown group), plus ssh-mcp healthcheck in HTTP (up and down) and stdio (valid and circular config) modes. Old and new registry and formatter output were identical.
• Review panel: claude-fable-5-1, gpt-6.1-sol and grok-4.7-high, then a final sol pass. None of them used a fallback model, and nothing blocking came up.

Note: the Dependency audit check will fail on this PR until #66 (or Dependabot's #65) lands. That is the pyjwt 2.13.0 advisory set already on main, not something this PR introduces.