Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

internal/scheduler/scheduler.go

@@ -3,7 +3,12 @@ package scheduler
 import (
 	"context"
 	"database/sql"
+	"fmt"
 	"log/slog"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
 	"sync"
 	"time"
 
@@ -124,6 +129,10 @@ func (s *Scheduler) cleanup() {
 	}
 	before := time.Now().AddDate(0, 0, -retentionDays)
 
+	if s.cfg.Scheduler.BackupDir != "" {
+		s.backupDB(before)
+	}
+
 	logRepo := models.NewJobLogRepository(s.db)
 	jobRepo := models.NewJobRepository(s.db)
 
@@ -141,5 +150,78 @@ func (s *Scheduler) cleanup() {
 
 	if deletedLogs > 0 || deletedJobs > 0 {
 		slog.Info("cleanup: purged old records", "logs_deleted", deletedLogs, "jobs_deleted", deletedJobs, "before", before.Format("2006-01-02"))
+		s.purgeJobLogFiles(before)
+	}
+
+	s.purgeOldBackups()
+}
+
+func (s *Scheduler) backupDB(before time.Time) {
+	backupDir := s.cfg.Scheduler.BackupDir
+	if backupDir == "" {
+		return
+	}
+	if err := os.MkdirAll(backupDir, 0700); err != nil {
+		slog.Error("cleanup: failed to create backup dir", "error", err)
+		return
+	}
+	ts := time.Now().UTC().Format("20060102-150405")
+	backupPath := filepath.Join(backupDir, fmt.Sprintf("syncserver-%s.db", ts))
+	if _, err := s.db.Exec(fmt.Sprintf("VACUUM INTO '%s'", backupPath)); err != nil {
+		slog.Error("cleanup: failed to vacuum into backup", "path", backupPath, "error", err)
+		return
+	}
+	slog.Info("cleanup: database backup created", "path", backupPath)
+}
+
+func (s *Scheduler) purgeJobLogFiles(before time.Time) {
+	logsDir := s.cfg.LogsDir()
+	entries, err := os.ReadDir(logsDir)
+	if err != nil {
+		return
+	}
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".log") {
+			continue
+		}
+		jobID := strings.TrimSuffix(entry.Name(), ".log")
+		id, err := strconv.ParseInt(jobID, 10, 64)
+		if err != nil {
+			continue
+		}
+		jobRepo := models.NewJobRepository(s.db)
+		job, err := jobRepo.GetByID(id)
+		if err != nil || job == nil {
+			os.Remove(filepath.Join(logsDir, entry.Name()))
+			continue
+		}
+		if job.FinishedAt != nil && job.FinishedAt.Before(before) {
+			os.Remove(filepath.Join(logsDir, entry.Name()))
+		}
+	}
+}
+
+func (s *Scheduler) purgeOldBackups() {
+	backupDir := s.cfg.Scheduler.BackupDir
+	retention := s.cfg.Scheduler.BackupRetentionDays
+	if backupDir == "" || retention <= 0 {
+		return
+	}
+	cutoff := time.Now().AddDate(0, 0, -retention)
+	entries, err := os.ReadDir(backupDir)
+	if err != nil {
+		return
+	}
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".db") {
+			continue
+		}
+		info, err := entry.Info()
+		if err != nil {
+			continue
+		}
+		if info.ModTime().Before(cutoff) {
+			os.Remove(filepath.Join(backupDir, entry.Name()))
+		}
 	}
 }