Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

internal/models/job.go

@@ -2,6 +2,8 @@ package models
 
 import (
 	"database/sql"
+	"fmt"
+	"strings"
 	"time"
 )
 
@@ -192,3 +194,53 @@ func (r *JobRepository) SetTotals(id int64, totalSize, sentBytes int64) error {
 	)
 	return err
 }
+
+func (r *JobRepository) GetByStatusAny(statuses []string) ([]Job, error) {
+	if len(statuses) == 0 {
+		return nil, nil
+	}
+	placeholders := make([]string, len(statuses))
+	args := make([]interface{}, len(statuses))
+	for i, s := range statuses {
+		placeholders[i] = "?"
+		args[i] = s
+	}
+	query := fmt.Sprintf(`
+		SELECT id, sync_pair_id, trigger_type, status, started_at, finished_at,
+			log_file, error_message, error_code, total_size_bytes, sent_bytes, created_at
+		FROM jobs WHERE status IN (%s)`, strings.Join(placeholders, ","))
+	rows, err := r.db.Query(query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var jobs []Job
+	for rows.Next() {
+		var j Job
+		var started, finished sql.NullTime
+		var logFile, errMsg, errCode sql.NullString
+		if err := rows.Scan(&j.ID, &j.SyncPairID, &j.TriggerType, &j.Status,
+			&started, &finished, &logFile, &errMsg, &errCode,
+			&j.TotalSizeBytes, &j.SentBytes, &j.CreatedAt); err != nil {
+			return nil, err
+		}
+		if started.Valid {
+			j.StartedAt = &started.Time
+		}
+		if finished.Valid {
+			j.FinishedAt = &finished.Time
+		}
+		if logFile.Valid {
+			j.LogFile = &logFile.String
+		}
+		if errMsg.Valid {
+			j.ErrorMessage = &errMsg.String
+		}
+		if errCode.Valid {
+			j.ErrorCode = &errCode.String
+		}
+		jobs = append(jobs, j)
+	}
+	return jobs, rows.Err()
+}