Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

internal/api/handlers_machines.go

@@ -252,13 +252,13 @@ func (h *MachineHandler) Shutdown(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	knownHostsPath, err := sshmanager.EnsureKnownHosts(filepath.Join("/var/lib/syncserver", "ssh"))
+	knownHostsPath, err := sshmanager.EnsureKnownHosts(h.cfg.SSHDir())
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "failed to ensure known_hosts")
 		return
 	}
 
-	privKeyPath := filepath.Join("/var/lib/syncserver", "ssh", "id_ed25519")
+	privKeyPath := filepath.Join(h.cfg.SSHDir(), "id_ed25519")
 	if m.SSHKeyID != nil {
 		sshKeyRepo := models.NewSSHKeyRepository(h.db)
 		sshKey, err := sshKeyRepo.GetByID(*m.SSHKeyID)
@@ -333,13 +333,13 @@ func (h *MachineHandler) TestConnection(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	knownHostsPath, err := sshmanager.EnsureKnownHosts(filepath.Join("/var/lib/syncserver", "ssh"))
+	knownHostsPath, err := sshmanager.EnsureKnownHosts(h.cfg.SSHDir())
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "failed to ensure known_hosts")
 		return
 	}
 
-	privKeyPath := filepath.Join("/var/lib/syncserver", "ssh", "id_ed25519")
+	privKeyPath := filepath.Join(h.cfg.SSHDir(), "id_ed25519")
 	if m.SSHKeyID != nil {
 		sshKeyRepo := models.NewSSHKeyRepository(h.db)
 		sshKey, err := sshKeyRepo.GetByID(*m.SSHKeyID)
@@ -390,14 +390,14 @@ func (h *MachineHandler) ApproveFingerprint(w http.ResponseWriter, r *http.Reque
 	}
 	json.NewDecoder(r.Body).Decode(&req)
 
-	sshDir := filepath.Join("/var/lib/syncserver", "ssh")
+	sshDir := h.cfg.SSHDir()
 	knownHostsPath, err := sshmanager.EnsureKnownHosts(sshDir)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "failed to ensure known_hosts")
 		return
 	}
 
-	privKeyPath := filepath.Join("/var/lib/syncserver", "ssh", "id_ed25519")
+	privKeyPath := filepath.Join(h.cfg.SSHDir(), "id_ed25519")
 	if m.SSHKeyID != nil {
 		sshKeyRepo := models.NewSSHKeyRepository(h.db)
 		sshKey, err := sshKeyRepo.GetByID(*m.SSHKeyID)
@@ -507,7 +507,7 @@ func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
 				seenKeys[sk.PrivateKeyPath] = true
 				keys = append(keys, sshmanager.DeployKey{
 					LocalPath:  sk.PrivateKeyPath,
-					RemotePath: "/var/lib/syncserver/ssh/keys/" + filepath.Base(sk.PrivateKeyPath),
+					RemotePath: h.cfg.SSHDir() + "/keys/" + filepath.Base(sk.PrivateKeyPath),
 					Mode:       0600,
 				})
 			}
@@ -526,6 +526,7 @@ func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
 		m.SSHUser,
 		keys,
 		knownHostsHosts,
+		h.cfg.SSHDir(),
 	)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())