fix: RunRemote SSH-to-source with pre-installed dest key, eliminating base64 round-trip

- Regenerate qnap.key and baby-nas.key to OpenSSH native format (387 bytes vs 119 PKCS8)
- Pre-install qnap.key on Baby NAS at /var/lib/syncserver/ssh/keys/
- Pre-populate Baby NAS known_hosts with Qnap host keys
- Simplify RunRemote: LXC SSH to Baby NAS, Baby NAS runs rsync with local qnap.key
- Remove wrapper script approach (rsync rejects remote-to-remote)

internal/syncengine/engine.go

@@ -264,20 +264,23 @@ func (e *Engine) Run(ctx context.Context, jobID int64, pairID int64) error {
 		destPrivKeyPath, err := e.resolveSSHKey(dstMachine)
 		if err != nil {
 			slog.Warn("failed to resolve destination SSH key, using server key", "error", err)
-			destPrivKeyPath = filepath.Join(e.cfg.SSHDir(), "id_ed25519")
+			destPrivKeyPath = ""
 		}
-		destPrivKeyBytes, err := os.ReadFile(destPrivKeyPath)
-		if err != nil {
-			slog.Warn("failed to read destination SSH key, using empty", "error", err)
-			destPrivKeyBytes = []byte{}
-		}
-		result, err = runner.RunRemote(jobCtx, cfg, RemoteMachine{
-			Host:        srcMachine.Host,
-			Port:        srcMachine.Port,
-			SSHUser:     srcMachine.SSHUser,
-			PrivKey:     privKey,
-			DestPrivKey: string(destPrivKeyBytes),
-		}, onLine)
+		result, err = runner.RunRemote(jobCtx, cfg,
+			&MachineKeys{
+				Host:    srcMachine.Host,
+				Port:    srcMachine.Port,
+				SSHUser: srcMachine.SSHUser,
+				PrivKey: privKey,
+			},
+			&MachineKeys{
+				Host:    dstMachine.Host,
+				Port:    dstMachine.Port,
+				SSHUser: dstMachine.SSHUser,
+				PrivKey: destPrivKeyPath,
+			},
+			destPrivKeyPath,
+			onLine)
 	} else {
 		result, err = runner.Run(jobCtx, cfg, onLine)
 	}