test: 补充单元测试覆盖率 29.9% → 36.6%

新建 18 个测试文件，追加 30 个已有测试文件，覆盖协议解析、
错误分类、CEL 表达式求值、YAML 反序列化、字节编码等纯函数。

plugins/services/ssh_test.go

@@ -0,0 +1,60 @@
+//go:build plugin_ssh || !plugin_selective
+
+package services
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestClassifySSHErrorType(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"unable to authenticate", errors.New("unable to authenticate"), ErrorTypeAuth},
+		{"no supported methods remain", errors.New("no supported methods remain"), ErrorTypeAuth},
+		{"handshake failed", errors.New("handshake failed"), ErrorTypeThrottle},
+		{"ssh disconnect", errors.New("ssh: disconnect"), ErrorTypeThrottle},
+		{"max startups", errors.New("max startups"), ErrorTypeThrottle},
+		{"connection refused", errors.New("connection refused"), ErrorTypeNetwork},
+		{"random error", errors.New("random error"), ErrorTypeUnknown},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifySSHErrorType(tt.err)
+			if got != tt.want {
+				t.Errorf("classifySSHErrorType(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestClassifySSHError(t *testing.T) {
+	authKeywords := []string{"bad password", "invalid key"}
+	throttleKeywords := []string{"rate limited", "too fast"}
+
+	tests := []struct {
+		name string
+		err  error
+		want ErrorType
+	}{
+		{"nil error", nil, ErrorTypeUnknown},
+		{"custom auth keyword", errors.New("bad password provided"), ErrorTypeAuth},
+		{"custom throttle keyword", errors.New("rate limited by server"), ErrorTypeThrottle},
+		{"network error", errors.New("connection refused"), ErrorTypeNetwork},
+		{"no match", errors.New("something else"), ErrorTypeUnknown},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := classifySSHError(tt.err, authKeywords, throttleKeywords)
+			if got != tt.want {
+				t.Errorf("classifySSHError(%v) = %v, want %v", tt.err, got, tt.want)
+			}
+		})
+	}
+}