Fix ApproveFingerprint: extract real host key via SSH instead of writing fingerprint SHA256 to known_hosts

The old ApproveFingerprint passed the SHA256 fingerprint string to
AddKnownHost which expected authorized_key format, causing known_hosts
entries to be corrupted and subsequent SSH connections (including shutdown)
to fail with "host key not found".

Changes:
- dialSSH now returns (conn, fingerprint, pubKey, error) with the raw
  ssh.PublicKey captured from the server
- New ConnectForApproval() wraps dialSSH with strictHostKeyChecking=false
  for the approval handshake
- ApproveFingerprint now opens an SSH connection to the host (non-strict),
  captures the real public key, and writes it in authorized_keys format
  to known_hosts via AddKnownHost
- shutdown.go updated to handle the new 4-value dialSSH return
- Supports optional host_key field in request body for direct key submission

internal/api/handlers_machines.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/syncserver/internal/config"
+	"golang.org/x/crypto/ssh"
 	"github.com/syncserver/internal/models"
 	"github.com/syncserver/internal/sshmanager"
 	"github.com/syncserver/internal/syncengine"
@@ -355,29 +356,63 @@ func (h *MachineHandler) ApproveFingerprint(w http.ResponseWriter, r *http.Reque
 
 	var req struct {
 		Fingerprint string `json:"fingerprint"`
+		HostKey    string `json:"host_key"`
 	}
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "invalid request body")
-		return
-	}
-	if req.Fingerprint == "" {
-		writeError(w, http.StatusBadRequest, "fingerprint is required")
+	json.NewDecoder(r.Body).Decode(&req)
+
+	sshDir := filepath.Join("/var/lib/syncserver", "ssh")
+	knownHostsPath, err := sshmanager.EnsureKnownHosts(sshDir)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to ensure known_hosts")
 		return
 	}
 
-	if err := repo.UpdateFingerprint(id, true, req.Fingerprint); err != nil {
+	privKeyPath := filepath.Join("/var/lib/syncserver", "ssh", "id_ed25519")
+	if m.SSHKeyID != nil {
+		sshKeyRepo := models.NewSSHKeyRepository(h.db)
+		sshKey, err := sshKeyRepo.GetByID(*m.SSHKeyID)
+		if err == nil && sshKey.PrivateKeyPath != "" {
+			privKeyPath = sshKey.PrivateKeyPath
+		}
+	}
+
+	var fingerprint, pubKeyLine string
+
+	if req.HostKey != "" {
+		pubKeyLine = req.HostKey
+	} else {
+		conn, fp, pubKey, err := sshmanager.ConnectForApproval(
+			context.Background(), m.Host, m.Port, m.SSHUser,
+			privKeyPath, knownHostsPath,
+		)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, fmt.Sprintf("could not retrieve host key: %v", err))
+			return
+		}
+		conn.Close()
+		fingerprint = fp
+		pubKeyLine = string(ssh.MarshalAuthorizedKey(pubKey))
+	}
+
+	if fingerprint == "" && req.Fingerprint != "" {
+		fingerprint = req.Fingerprint
+	}
+
+	if pubKeyLine != "" {
+		if err := sshmanager.AddKnownHost(sshDir, m.Host, m.Port, []byte(pubKeyLine)); err != nil {
+			writeError(w, http.StatusInternalServerError, fmt.Sprintf("failed to add known_host entry: %v", err))
+			return
+		}
+	}
+
+	if err := repo.UpdateFingerprint(id, true, fingerprint); err != nil {
 		slog.Error("failed to update fingerprint", "id", id, "error", err)
 		writeError(w, http.StatusInternalServerError, "failed to update fingerprint")
 		return
 	}
 
-	sshDir := filepath.Join("/var/lib/syncserver", "ssh")
-	if err := sshmanager.AddKnownHost(sshDir, m.Host, m.Port, []byte(req.Fingerprint)); err != nil {
-		slog.Warn("failed to add known_host entry", "host", m.Host, "error", err)
-	}
-
 	m.FingerprintConfirmed = true
-	m.HostKeyFingerprint = &req.Fingerprint
+	m.HostKeyFingerprint = &fingerprint
 	writeJSON(w, machineToResp(*m))
 }