fix: capture SCP stderr for better error messages

frontend/app.py

@@ -475,7 +475,8 @@ def scp_start(
 
     logger.info("Starting SCP pull: %s → %s", remote, dest)
     try:
-        proc = subprocess.Popen(cmd, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        proc = subprocess.Popen(cmd, env=env, stdout=subprocess.DEVNULL,
+                                stderr=subprocess.PIPE, text=True)
     except Exception as exc:
         return JSONResponse({"phase": "error", "error": f"Failed to start SCP: {exc}"}, status_code=500)
 
@@ -516,11 +517,17 @@ def scp_progress(session_id: str, filename: str):
     if poll is not None:
         _active_scp.pop(key, None)
         if poll != 0:
+            stderr_output = ""
+            try:
+                stderr_output = proc.stderr.read()[:500] if proc.stderr else ""
+            except Exception:
+                pass
             if dest.exists():
                 dest.unlink(missing_ok=True)
+            logger.error("SCP pull failed (rc=%d): %s", poll, stderr_output)
             return JSONResponse({
                 "phase": "error",
-                "error": f"SCP pull failed (exit code {poll}). Check credentials and remote path.",
+                "error": f"SCP pull failed (exit code {poll}). {stderr_output}",
                 "file_size_bytes": current_bytes,
             })
         final_bytes = dest.stat().st_size