feat: add direct server-to-server file transfer (--transfer)

[jamiesun]

Summary

Adds a new transfer mode that streams files directly from one server to another over SFTP, relaying data through the local machine without writing to local disk.

sshx --transfer=<src-host>:<src-path> --to=<dst-host>:<dst-path>

# Examples
sshx --transfer=192.168.1.100:/var/log/app.log --to=192.168.1.101:/backup/app.log
sshx --transfer=prod-web:/etc/nginx/nginx.conf --to=staging-web:/etc/nginx/nginx.conf
sshx --transfer=prod-db:/var/backups --to=backup-server:/mnt/archive/db   # recursive
sshx --transfer=prod-web:/data --to=prod-db:/data --dry-run               # plan preview

Features

• Single files and recursive directory transfers
• Preserves file permission bits
• If the destination is an existing directory, the source is placed inside it
• Both endpoints can be configured host names (from ~/.sshx/settings.json) or IPs, each resolving its own SSH key / user / port
• Non-regular files (symlinks, devices) are skipped with a warning

Implementation

• internal/sshclient/transfer.go (new): TransferTo() opens SFTP sessions on both connections and streams src → dst
• internal/app/transfer.go (new): HandleTransfer() derives per-endpoint configs, resolves hosts from settings, connects both sides
• internal/app/config.go: parses --transfer=host:path and --to=host:path (SFTP --to semantics unchanged)
• internal/app/dryrun.go / audit.go: transfer mode support (transfer_source / transfer_destination fields, config validation, audit action)
• Docs updated: --help, README, README_CN

Testing

• 7 new unit tests: arg parsing, host:path splitting, missing src/dst validation, dry-run plan (valid + invalid)
• go build, go vet, full go test ./..., golangci-lint (0 issues), gofmt all pass
• Smoke-tested dry-run text/JSON output and the connect-failure error path