Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

internal/api/handlers_syncpairs.go

@@ -3,10 +3,12 @@ package api
 import (
 	"database/sql"
 	"encoding/json"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"regexp"
 	"strconv"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/syncserver/internal/models"
@@ -22,6 +24,23 @@ func NewSyncPairHandler(db *sql.DB) *SyncPairHandler {
 
 var directionRegex = regexp.MustCompile(`^(push|pull|mirror)$`)
 
+func ValidatePath(path string) error {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return fmt.Errorf("path cannot be empty")
+	}
+	if strings.Contains(path, "..") {
+		return fmt.Errorf("path cannot contain '..'")
+	}
+	if strings.HasPrefix(path, "-") {
+		return fmt.Errorf("path cannot start with '-'")
+	}
+	if strings.Contains(path, "\x00") {
+		return fmt.Errorf("path cannot contain null bytes")
+	}
+	return nil
+}
+
 func (h *SyncPairHandler) List(w http.ResponseWriter, r *http.Request) {
 	repo := models.NewSyncPairRepository(h.db)
 	pairs, err := repo.GetAll()
@@ -68,6 +87,14 @@ func (h *SyncPairHandler) Create(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "name, source_path and dest_path are required")
 		return
 	}
+	if err := ValidatePath(req.SourcePath); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid source_path: "+err.Error())
+		return
+	}
+	if err := ValidatePath(req.DestPath); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid dest_path: "+err.Error())
+		return
+	}
 	if req.Direction == "" {
 		req.Direction = "push"
 	}
@@ -127,6 +154,14 @@ func (h *SyncPairHandler) Update(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "name, source_path and dest_path are required")
 		return
 	}
+	if err := ValidatePath(req.SourcePath); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid source_path: "+err.Error())
+		return
+	}
+	if err := ValidatePath(req.DestPath); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid dest_path: "+err.Error())
+		return
+	}
 	if !directionRegex.MatchString(req.Direction) {
 		writeError(w, http.StatusBadRequest, "direction must be push, pull, or mirror")
 		return