Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

internal/db/db.go

@@ -1,7 +1,9 @@
 package db
 
 import (
+	"crypto/sha256"
 	"database/sql"
+	"encoding/hex"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -62,6 +64,7 @@ func (db *DB) runMigrationsInternal(mfs embedFS, migrationsRoot string) error {
 	if _, err := db.Exec(`
 		CREATE TABLE IF NOT EXISTS schema_migrations (
 			version TEXT PRIMARY KEY,
+			checksum TEXT,
 			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
 		)
 	`); err != nil {
@@ -69,13 +72,9 @@ func (db *DB) runMigrationsInternal(mfs embedFS, migrationsRoot string) error {
 	}
 
 	for _, name := range names {
-		var applied bool
-		row := db.QueryRow("SELECT 1 FROM schema_migrations WHERE version = ?", name)
-		if err := row.Scan(&applied); err == nil {
-			applied = true
-		}
-
-		if applied {
+		var storedChecksum string
+		row := db.QueryRow("SELECT checksum FROM schema_migrations WHERE version = ?", name)
+		if err := row.Scan(&storedChecksum); err == nil && storedChecksum != "" {
 			continue
 		}
 
@@ -84,13 +83,30 @@ func (db *DB) runMigrationsInternal(mfs embedFS, migrationsRoot string) error {
 			return fmt.Errorf("reading migration %s: %w", name, err)
 		}
 
-		if _, err := db.Exec(string(data)); err != nil {
+		checksum := sha256.Sum256(data)
+		checksumHex := hex.EncodeToString(checksum[:])
+
+		tx, err := db.Begin()
+		if err != nil {
+			return fmt.Errorf("starting transaction for migration %s: %w", name, err)
+		}
+
+		if _, err := tx.Exec(string(data)); err != nil {
+			tx.Rollback()
 			return fmt.Errorf("applying migration %s: %w", name, err)
 		}
 
-		if _, err := db.Exec("INSERT INTO schema_migrations (version) VALUES (?)", name); err != nil {
+		if _, err := tx.Exec(
+			"INSERT INTO schema_migrations (version, checksum) VALUES (?, ?)",
+			name, checksumHex,
+		); err != nil {
+			tx.Rollback()
 			return fmt.Errorf("recording migration %s: %w", name, err)
 		}
+
+		if err := tx.Commit(); err != nil {
+			return fmt.Errorf("committing migration %s: %w", name, err)
+		}
 	}
 
 	return nil