Use transaction to replace sandbox keys

Delete existing SSH and Tailscale keys in a transaction before inserting
new rows (use eq from drizzle-orm). Update the SshKeys UI to convert
escaped \n to real newlines when loading, and to return masked private
keys with newlines escaped as \n.

apps/api/src/xrpc/io/pocketenv/sandbox/putSshKeys.ts

···
 import { XRPCError, type HandlerAuth } from "@atproto/xrpc-server";
 import type { Context } from "context";
+import { eq } from "drizzle-orm";
 import type { Server } from "lexicon";
 import type { InputSchema } from "lexicon/types/io/pocketenv/sandbox/putSshKeys";
 import sshKeys from "schema/ssh-keys";
···
       throw new XRPCError(401, "Unauthorized");
     }
 
-    await ctx.db
-      .insert(sshKeys)
-      .values({
-        publicKey: input.publicKey,
-        privateKey: input.privateKey,
-        redacted: input.redacted,
-        sandboxId: input.id,
-      })
-      .execute();
+    await ctx.db.transaction(async (tx) => {
+      await tx.delete(sshKeys).where(eq(sshKeys.sandboxId, input.id)).execute();
+      await tx
+        .insert(sshKeys)
+        .values({
+          publicKey: input.publicKey,
+          privateKey: input.privateKey,
+          redacted: input.redacted,
+          sandboxId: input.id,
+        })
+        .execute();
+    });
 
     return {};
   };

apps/api/src/xrpc/io/pocketenv/sandbox/putTailscaleAuthKey.ts

···
 import { XRPCError, type HandlerAuth } from "@atproto/xrpc-server";
 import type { Context } from "context";
+import { eq } from "drizzle-orm";
 import type { Server } from "lexicon";
 import type { InputSchema } from "lexicon/types/io/pocketenv/sandbox/putTailscaleAuthKey";
 import tailscaleAuthKeys from "schema/tailscale-auth-keys";
···
       throw new XRPCError(401, "Unauthorized");
     }
 
-    await ctx.db
-      .insert(tailscaleAuthKeys)
-      .values({
-        sandboxId: input.id,
-        authKey: input.authKey,
-        redacted: input.redacted || "",
-      })
-      .execute();
+    await ctx.db.transaction(async (tx) => {
+      await tx
+        .delete(tailscaleAuthKeys)
+        .where(eq(tailscaleAuthKeys.sandboxId, input.id))
+        .execute();
+      await tx
+        .insert(tailscaleAuthKeys)
+        .values({
+          sandboxId: input.id,
+          authKey: input.authKey,
+          redacted: input.redacted || "",
+        })
+        .execute();
+    });
 
     return {};
   };

apps/web/src/pages/settings/sshkeys/SshKeys.tsx

···
 
   useEffect(() => {
     if (sshKeys?.data) {
-      setValue("privateKey", sshKeys.data.privateKey);
+      setValue("privateKey", sshKeys.data.privateKey.replace(/\\n/g, "\n"));
       setValue("publicKey", sshKeys.data.publicKey);
     }
   }, [sshKeys, setValue]);
···
           const headerIndex = values.privateKey.indexOf(header);
           const footerIndex = values.privateKey.indexOf(footer);
           if (headerIndex === -1 || footerIndex === -1)
-            return values.privateKey;
-          const body = values.privateKey
-            .slice(headerIndex + header.length, footerIndex)
-            .trim();
+            return values.privateKey.replace(/\n/g, "\\n");
+          const body = values.privateKey.slice(
+            headerIndex + header.length,
+            footerIndex,
+          );
           const chars = body.split("");
           const nonNewlineIndices = chars
             .map((c, i) => (c !== "\n" ? i : -1))
···
                   return chars.join("");
                 })()
               : body;
-          return `${header}\n${maskedBody}\n${footer}`;
+          return `${header}${maskedBody}${footer}`.replace(/\n/g, "\\n");
         })(),
       });
     }