fix: EventBus panic on SSE disconnect + JWT secret persistence + recover() guards

- eventbus.go: Fix send-on-closed-channel panic in SubscribeGlobal by
  using a done channel; add recover() in fan-out goroutine; track active
  global subs for proper cleanup on unsubscribe
- config.go: Persist JWT secret to $DATA_DIR/.jwt_secret instead of
  regenerating a random one on every restart (which invalidated all sessions)
- handlers_ws.go: Replace time.After with time.Ticker to fix timer leak in
  SSE keepalive loop
- handlers_jobs.go: Add recover() in fire-and-forget job goroutine; fix nil
  pointer deref when GetByID fails after job creation
- handlers_machines.go: Add recover() in ProbeAllMachines goroutine
- scheduler.go: Add recover() in scheduled job run goroutine
- engine.go: Add recover() in per-machine probe goroutines

internal/api/handlers_jobs.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"os"
 	"strconv"
@@ -150,11 +151,20 @@ func (h *JobHandler) TriggerRun(w http.ResponseWriter, r *http.Request) {
 	}
 
 	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				slog.Error("job run goroutine panicked", "job_id", jobID, "panic", r)
+			}
+		}()
 		h.engine.Run(r.Context(), jobID, pairID)
 	}()
 
 	jobRepo := models.NewJobRepository(h.db)
-	j, _ := jobRepo.GetByID(jobID)
+	j, err := jobRepo.GetByID(jobID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to fetch created job")
+		return
+	}
 	writeJSON(w, jobToResp(*j), http.StatusCreated)
 }