fix: EventBus panic on SSE disconnect + JWT secret persistence + recover() guards

- eventbus.go: Fix send-on-closed-channel panic in SubscribeGlobal by
  using a done channel; add recover() in fan-out goroutine; track active
  global subs for proper cleanup on unsubscribe
- config.go: Persist JWT secret to $DATA_DIR/.jwt_secret instead of
  regenerating a random one on every restart (which invalidated all sessions)
- handlers_ws.go: Replace time.After with time.Ticker to fix timer leak in
  SSE keepalive loop
- handlers_jobs.go: Add recover() in fire-and-forget job goroutine; fix nil
  pointer deref when GetByID fails after job creation
- handlers_machines.go: Add recover() in ProbeAllMachines goroutine
- scheduler.go: Add recover() in scheduled job run goroutine
- engine.go: Add recover() in per-machine probe goroutines

internal/api/handlers_ws.go

@@ -38,6 +38,9 @@ func (h *SSEHandler) StreamAll(w http.ResponseWriter, r *http.Request) {
 	events, unsub := h.engine.SubscribeGlobal()
 	defer unsub()
 
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
+
 	for {
 		select {
 		case evt := <-events:
@@ -46,7 +49,7 @@ func (h *SSEHandler) StreamAll(w http.ResponseWriter, r *http.Request) {
 			flusher.Flush()
 		case <-r.Context().Done():
 			return
-		case <-time.After(30 * time.Second):
+		case <-ticker.C:
 			fmt.Fprintf(w, ": keepalive\n\n")
 			flusher.Flush()
 		}
@@ -84,6 +87,9 @@ func (h *SSEHandler) StreamJob(w http.ResponseWriter, r *http.Request) {
 	events, unsub := h.engine.SubscribeJob(jobID)
 	defer unsub()
 
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
+
 	for {
 		select {
 		case evt := <-events:
@@ -92,7 +98,7 @@ func (h *SSEHandler) StreamJob(w http.ResponseWriter, r *http.Request) {
 			flusher.Flush()
 		case <-r.Context().Done():
 			return
-		case <-time.After(30 * time.Second):
+		case <-ticker.C:
 			fmt.Fprintf(w, ": keepalive\n\n")
 			flusher.Flush()
 		}