Add ephemeral JIT and --credential override for KeeperRDP Proxy tunnels

[idimov-keeper]

• Adds --credential/-cr to pam tunnel start to explicitly select a credential for KeeperRDP Proxy tunnels, overriding ephemeral/linked records; ignored for plain tunnels.
• Bumps the gateway wait timeout to 120s for ephemeral account creation on pam tunnel start --proxy.
• Launch-credential preflight for --keeper-db-proxy/--keeper-proxy now falls back to jitSettings.createEphemeral when no static launch credential is assigned.

Note: --credential won't actually override ephemeral until the corresponding Gateway change (feat/keeperrdp-proxy-gateway) ships.