Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

web/src/App.tsx

@@ -6,6 +6,7 @@ import {
   NavLink,
   Outlet,
   useNavigate,
+  Link,
 } from 'react-router-dom';
 import { useState, useEffect } from 'react';
 import { Toaster } from 'sonner';
@@ -20,6 +21,8 @@ import {
   LogOut,
   Menu,
   X,
+  Clock,
+  ArrowLeft,
 } from 'lucide-react';
 import { ErrorBoundary } from './components/ErrorBoundary';
 import { Spinner } from './components/ui/Spinner';
@@ -34,11 +37,13 @@ import JobHistory from './pages/JobHistory';
 import JobDetail from './pages/JobDetail';
 import SettingsPage from './pages/Settings';
 import SSHKeys from './pages/SSHKeys';
+import Schedules from './pages/Schedules';
 
 const navItems = [
   { to: '/', label: 'Dashboard', icon: LayoutDashboard },
   { to: '/machines', label: 'Machines', icon: Server },
   { to: '/sync-pairs', label: 'Sync Pairs', icon: GitCompare },
+  { to: '/schedules', label: 'Schedules', icon: Clock },
   { to: '/jobs', label: 'Jobs', icon: History },
   { to: '/ssh-keys', label: 'SSH Keys', icon: Key },
   { to: '/settings', label: 'Settings', icon: SettingsIcon },
@@ -217,6 +222,21 @@ function Layout() {
   );
 }
 
+function NotFound() {
+  return (
+    <div className="flex flex-col items-center justify-center min-h-[50vh] gap-3">
+      <p className="text-2xl font-bold text-fg">404</p>
+      <p className="text-fg-muted">Page not found</p>
+      <Button variant="secondary" asChild>
+        <Link to="/">
+          <ArrowLeft className="h-4 w-4" />
+          Back to Dashboard
+        </Link>
+      </Button>
+    </div>
+  );
+}
+
 export default function App() {
   return (
     <BrowserRouter>
@@ -233,12 +253,13 @@ export default function App() {
             <Route path="/" element={<Dashboard />} />
             <Route path="/machines" element={<Machines />} />
             <Route path="/sync-pairs" element={<SyncPairs />} />
+            <Route path="/schedules" element={<Schedules />} />
             <Route path="/jobs" element={<JobHistory />} />
             <Route path="/jobs/:id" element={<JobDetail />} />
             <Route path="/ssh-keys" element={<SSHKeys />} />
             <Route path="/settings" element={<SettingsPage />} />
           </Route>
-          <Route path="*" element={<Navigate to="/" />} />
+          <Route path="*" element={<NotFound />} />
         </Routes>
       </ErrorBoundary>
     </BrowserRouter>