Bastion Access and Restricted SSH Forwarding

server2 only accepts administration from server1, and its app listens on loopback. Reach it through the bastion without copying a private key anywhere, tunnel to the app on loopback only, and narrow what the bastion will forward.