Phase 1: resilient SSH handling + Push Conf button

partnership_onboard.sh (--phase1-only):
- Test if SSH already works first (BatchMode) — skip ssh-copy-id if yes
- If ssh-copy-id fails (no TTY in background): soft-fail, generate key locally,
  print pubkey for manual install, write HOST2_KEY_READY=true, run local setup
- Only skip conf push if SSH truly unavailable; otherwise proceeds normally
- Exit 0 with clear manual-step instructions instead of hard failure

include/partnership.php:
- Read HOST2_KEY_READY from setup.db; expose as key_ready on remote nodes

pages/partnership.php:
- Node card: amber "Key generated · install on HOST2 then Push Conf" badge
  when key_ready=true and phase=0
- "Push Conf (key installed)" button appears when key_ready=true — runs
  --phase1-only --skip-ssh (assumes user manually did ssh-copy-id)
- vvPtPushConf() top-level function

Partnership/partnership_onboard.sh

@@ -559,8 +559,47 @@ MASTER_PUSH_OK=false
 echo "━━━ Step 1 — SSH Key Setup ━━━"
 
 if [[ "$SKIP_SSH" == true ]]; then
-    warn "Skipping (--skip-ssh / --phase2-only)"
+    warn "Skipping (--skip-ssh)"
     STEP_SSH_OK=true
+elif [[ "$PHASE1_ONLY" == true ]]; then
+    # Phase 1 in background: test if SSH already works first — avoids ssh-copy-id
+    # hanging for a password prompt with no TTY.
+    if timeout "$SSH_TIMEOUT" ssh -i "$SSH_KEY" \
+        -o ConnectTimeout="$SSH_TIMEOUT" -o BatchMode=yes root@"$MIRROR_IP" exit 0 2>/dev/null; then
+        log "SSH to $MIRROR already works ✅ — skipping key install"
+        STEP_SSH_OK=true
+    else
+        # Key not yet on HOST2 — try ssh_setup.sh (works interactively, may fail in background)
+        if bash "$SCRIPT_DIR/ssh_setup.sh" "${EXTRA_FLAGS[@]}"; then
+            log "SSH keys ready ✅"
+            STEP_SSH_OK=true
+        else
+            # Soft-fail: generate key locally if not present, then tell user to install manually
+            warn "Could not install key on $MIRROR automatically (no terminal for password prompt)"
+            if [[ -f "$SSH_KEY" ]]; then
+                log "Local key exists at: $SSH_KEY"
+            else
+                bash "$SCRIPT_DIR/ssh_setup.sh" --key-only "${EXTRA_FLAGS[@]}" 2>/dev/null || true
+            fi
+            if [[ -f "${SSH_KEY}.pub" ]]; then
+                echo ""
+                echo "  Install this key on $MIRROR to complete SSH setup:"
+                echo "  ┌─────────────────────────────────────────────────────"
+                cat "${SSH_KEY}.pub" | sed 's/^/  │ /'
+                echo "  └─────────────────────────────────────────────────────"
+                echo "  Run on a terminal: ssh-copy-id -i ${SSH_KEY}.pub root@${MIRROR_IP}"
+                echo "  Then click 'Push Conf' in the Partnership tab."
+                # Write key-ready flag so UI can show the manual-install state
+                [[ "$DRY_RUN" == false ]] && {
+                    local kflag="${MIRROR_ID}_KEY_READY"
+                    grep -q "^${kflag}=" /boot/config/varaverk_setup.db 2>/dev/null \
+                        && sed -i "s|^${kflag}=.*|${kflag}=true|" /boot/config/varaverk_setup.db \
+                        || echo "${kflag}=true" >> /boot/config/varaverk_setup.db
+                }
+            fi
+            STEP_SSH_OK=false
+        fi
+    fi
 elif bash "$SCRIPT_DIR/ssh_setup.sh" "${EXTRA_FLAGS[@]}"; then
     log "SSH keys ready ✅"
     STEP_SSH_OK=true
@@ -574,6 +613,30 @@ fi
 # --phase1-only: SSH + conf push is all HOST1 needs to do before HOST2 installs Varaverk.
 # HOST2's wizard will detect the pushed master.conf + state file and take the correct path.
 if [[ "$PHASE1_ONLY" == true ]]; then
+    if [[ "$STEP_SSH_OK" == false ]]; then
+        # SSH key not yet installed on HOST2 — can't push conf, but local setup still runs.
+        # UI will show "key ready, install manually" state via HOST2_KEY_READY flag.
+        echo ""
+        echo "━━━ Phase 1 — HOST1 Local Setup (SSH pending) ━━━"
+        bash "$SCRIPT_DIR/partnership_manager.sh" --onboard --local-only "${EXTRA_FLAGS[@]}" || \
+            warn "Local setup had issues — FolderView3 may need manual setup"
+
+        END=$(date +%s)
+        echo ""
+        echo "━━━━━ $ICON_SUMMARY PHASE 1 — SSH PENDING ━━━━━"
+        echo "  SSH keys:    key generated ✅ — NOT yet installed on $MIRROR ⚠"
+        echo "  Conf push:   skipped (needs SSH access to $MIRROR)"
+        echo "  HOST1 setup: done ✅"
+        echo "  Duration:    $(format_duration $(( END - START )))"
+        echo ""
+        echo "  ACTION NEEDED: install the key on $MIRROR:"
+        echo "    ssh-copy-id -i ${SSH_KEY}.pub root@${MIRROR_IP}"
+        echo "  Then click 'Push Conf' in Partnership tab, or run:"
+        echo "    bash Partnership/partnership_onboard.sh --phase1-only --skip-ssh"
+        echo "━━━━━━━━━━━━━━━━━━━━━━━"
+        exit 0
+    fi
+
     echo ""
     echo "━━━ Phase 1 — Conf Push ━━━"