fix(cli): honour ax ssh --help and stop global flag parsing at --

[anzal1]

Fixes #373. Fixes #410.

What was wrong

1. ax ssh --help treated --help as the task name, resolved the server (possibly starting a port-forward), and then failed with task "--help" not found.
2. The global flag loop in main() kept consuming -a, -n, --server and --context after --. So ax ssh t -- grep -n foo file silently set the namespace to foo and ran grep file remotely, and ax ssh t -- ls -a /tmp switched the atespace to /tmp.

Change

• The global flag loop moves into parseGlobalArgs, which stops at -- and passes everything after it to the command unchanged. Behaviour before -- is the same as before.
• The ssh argument handling moves into parseSSHArgs. main calls it before resolving the server, so -h/--help prints ssh usage (exit 0) and a missing task name or unknown flag fails immediately (exit 1) without touching the cluster.
• --help after the task name still goes to the remote command (ax ssh t -- git --help).
• Table-driven tests for both parsers in cmd/ax/main_test.go, the first tests for that package.

Testing

make test              # passes
ax ssh --help          # prints ssh usage, exit 0
ax ssh                 # prints usage + "Error: missing task name", exit 1

Not covered here: #374 (ax ssh <task> with no command exits immediately because stdin is never forwarded). That needs protocol changes in internal/guest and deserves its own PR.