fix(trino): harden ticket authentication defaults

[Maxteabag]

Follow-up to #283.

Summary

• derive a working GSSAPI service target while preserving the remote hostname across SSH tunnel rewrites
• preserve each Trino authentication driver’s mutual-authentication default unless explicitly overridden
• keep required Kerberos/GSSAPI target fields in the main form while leaving delegation and mutual-authentication overrides advanced
• skip keyring and password-command resolution for ticket-based and passwordless Trino authentication

Testing

• uv run pytest tests/unit -q
• focused authentication/password tests (58 passed)
• structured autoreview: clean