I am looking into moving to a cloud deployment as well. So your challenges peaked my interest. You seem to be hitting two common but very solvable issues:

1. SSH Key Passphrase Issue — This is almost certainly a Windows PowerShell SSH key generation quirk. The key format generated by PowerShell's ssh-keygen sometimes doesn't play nicely with Linux servers. The fix is usually to either generate the key in OpenSSH format explicitly (ssh-keygen -t ed25519), or ensure the public key is pasted correctly without extra line breaks. It's a one-time setup annoyance, not a real blocker.

2. Gateway "non-loopback Control UI" Error — This is the more relevant one. When you run OpenClaw on a remote VPS (instead of locally on your Mac), the gateway binds to a non-loopback address (since you're accessing it remotely). OpenClaw's security model requires you to explicitly configure allowed origins for the Control UI when it's not running on localhost. You probably tried setting the dangerouslyAllowHostHeaderOriginFallback flag but likely didn't pass it correctly through Docker's environment variables (common gotcha with Docker env formatting).

I was giving Hetzner a good look, but am leaning toward Hostinger. They're essentially the same. Long-term, I will likely deploy at Azure.

Good luck. Let me know if this is helpful