fix: SQLite WAL mode + log all swallowed 500 errors

- internal/db/db.go: Use _pragma syntax so modernc.org/sqlite actually
  applies busy_timeout(5000) and journal_mode(WAL). Eliminates SQLITE_BUSY
  500s when concurrent reads hit a writer holding the DELETE-mode lock.
- internal/api/handlers_*.go: Add slog.Error before every writeError with
  StatusInternalServerError so real errors appear in logs (30+ sites across
  handlers_jobs, handlers_machines, handlers_syncpairs, handlers_sshkeys).

internal/api/handlers_sshkeys.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -32,6 +33,7 @@ func (h *SSHKeyHandler) List(w http.ResponseWriter, r *http.Request) {
 	machineRepo := models.NewMachineRepository(h.db)
 	keys, err := repo.GetAll()
 	if err != nil {
+		slog.Error("failed to fetch ssh keys", "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to fetch ssh keys")
 		return
 	}
@@ -87,6 +89,7 @@ func (h *SSHKeyHandler) Create(w http.ResponseWriter, r *http.Request) {
 
 	keysDir := filepath.Join(h.cfg.SSHDir(), "keys")
 	if err := os.MkdirAll(keysDir, 0700); err != nil {
+		slog.Error("failed to create keys directory", "path", keysDir, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to create keys directory")
 		return
 	}
@@ -97,6 +100,7 @@ func (h *SSHKeyHandler) Create(w http.ResponseWriter, r *http.Request) {
 	if req.Generate {
 		privPath, _, pubKey, fp, err = sshmanager.GenerateKeyPair(req.Label, keysDir)
 		if err != nil {
+			slog.Error("generating key", "label", req.Label, "error", err)
 			writeError(w, http.StatusInternalServerError, fmt.Sprintf("generating key: %v", err))
 			return
 		}
@@ -113,6 +117,7 @@ func (h *SSHKeyHandler) Create(w http.ResponseWriter, r *http.Request) {
 	repo := models.NewSSHKeyRepository(h.db)
 	id, err := repo.Create(req.Label, privPath, pubKey)
 	if err != nil {
+		slog.Error("failed to store ssh key", "label", req.Label, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to store ssh key")
 		return
 	}
@@ -140,6 +145,7 @@ func (h *SSHKeyHandler) Get(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if err != nil {
+		slog.Error("failed to fetch ssh key", "id", id, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to fetch ssh key")
 		return
 	}
@@ -195,6 +201,7 @@ func (h *SSHKeyHandler) Delete(w http.ResponseWriter, r *http.Request) {
 		os.Remove(k.PrivateKeyPath + ".pub")
 	}
 	if err := repo.Delete(id); err != nil {
+		slog.Error("failed to delete ssh key", "id", id, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to delete ssh key")
 		return
 	}
@@ -214,6 +221,7 @@ func (h *SSHKeyHandler) DownloadPrivate(w http.ResponseWriter, r *http.Request)
 		return
 	}
 	if err != nil {
+		slog.Error("failed to fetch ssh key", "id", id, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to fetch ssh key")
 		return
 	}
@@ -224,6 +232,7 @@ func (h *SSHKeyHandler) DownloadPrivate(w http.ResponseWriter, r *http.Request)
 
 	data, err := os.ReadFile(k.PrivateKeyPath)
 	if err != nil {
+		slog.Error("failed to read private key", "path", k.PrivateKeyPath, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to read private key")
 		return
 	}