Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

internal/syncengine/eventbus.go

@@ -8,20 +8,17 @@ import (
 type EventBus struct {
 	subscribers map[int64]map[chan Event]struct{}
 	mu          sync.RWMutex
-	global      chan Event
 	bufferSize  int
 	globalSubs  []globalSub
 }
 
 type globalSub struct {
-	ch   chan Event
-	done chan struct{}
+	ch chan Event
 }
 
 func NewEventBus(bufferSize int) *EventBus {
 	return &EventBus{
 		subscribers: make(map[int64]map[chan Event]struct{}),
-		global:      make(chan Event, bufferSize),
 		bufferSize:  bufferSize,
 		globalSubs:  nil,
 	}
@@ -51,32 +48,10 @@ func (eb *EventBus) Subscribe(jobID int64) (chan Event, func()) {
 
 func (eb *EventBus) SubscribeGlobal() (chan Event, func()) {
 	ch := make(chan Event, eb.bufferSize)
-	done := make(chan struct{})
 	eb.mu.Lock()
-	eb.globalSubs = append(eb.globalSubs, globalSub{ch: ch, done: done})
+	eb.globalSubs = append(eb.globalSubs, globalSub{ch: ch})
 	eb.mu.Unlock()
-	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				slog.Error("SubscribeGlobal goroutine panicked", "reason", r)
-			}
-			close(ch)
-		}()
-		for {
-			select {
-			case evt := <-eb.global:
-				select {
-				case ch <- evt:
-				default:
-					slog.Warn("global event subscriber buffer full, dropping event", "type", evt.Type)
-				}
-			case <-done:
-				return
-			}
-		}
-	}()
 	return ch, func() {
-		close(done)
 		eb.mu.Lock()
 		for i, s := range eb.globalSubs {
 			if s.ch == ch {
@@ -85,6 +60,7 @@ func (eb *EventBus) SubscribeGlobal() (chan Event, func()) {
 			}
 		}
 		eb.mu.Unlock()
+		close(ch)
 	}
 }
 
@@ -102,10 +78,12 @@ func (eb *EventBus) Publish(evt Event) {
 		}
 	}
 
-	select {
-	case eb.global <- evt:
-	default:
-		slog.Warn("global event bus full, dropping event", "type", evt.Type)
+	for _, sub := range eb.globalSubs {
+		select {
+		case sub.ch <- evt:
+		default:
+			slog.Warn("global event subscriber buffer full, dropping event", "type", evt.Type)
+		}
 	}
 }