Phase A-E: stability, security, observability, and test coverage

Phase A - Stability:
- Engine.Start(): recovers orphaned jobs (running/queued/waking_up) after crash
- Engine.Stop(): graceful shutdown - cancels all in-flight jobs and waits
- Queue keyed by jobID (not syncPairID): cancel now targets exact job
- Local rsync uses jobCtx (context.Background() replaced)
- Migrations wrapped in transactions; checksums stored

Phase B - Security:
- admin/admin default removed: SYNCSERVER_ADMIN_PASSWORD required on first run
- Path validation: rejects .., leading -, null bytes in sync pair paths
- Rsync flags allowlist: dangerous flags blocked (--rsync-path, -e, --files-from)
- Shell concat in RunRemote replaced with proper sh -c escaping
- knownhosts: replaced custom parser with golang.org/x/crypto/ssh/knownhosts
- RequireAdmin wired: machine CRUD, SSH key ops, settings require admin role
- deploy-keys: uses authorized_keys only (no private key upload)
- Hardcoded /var/lib/syncserver/ssh paths replaced with cfg.SSHDir()

Phase C - Operational:
- /readyz health check: DB query + SSH dir accessibility
- /metrics endpoint: Prometheus text format (jobs, queue, machines)
- Event struct JSON tags: job_id, machine_id, type (snake_case)
- EventBus broadcast: fanned out to all subscribers
- SQLite VACUUM INTO backup: scheduled before cleanup if BackupDir set
- Filesystem job log cleanup: removes .log files for purged jobs
- Backup retention: old backups auto-purged

Phase D - Frontend:
- Schedules page: REST API + full CRUD UI for cron schedules
- Dashboard: cancel button for running/queued jobs
- JobDetail: server-side log download via API
- Settings: displays data_dir from server
- 404 page: proper NotFound component

Phase E - Tests:
- auth_test.go: JWT, bcrypt, middleware, seed (18 tests)
- models_test.go: Job, Machine, SyncPair, Schedule repos (18 tests)
- go test -race: no data races found

web/src/pages/JobDetail.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useState, useRef, useCallback } from 'react';
 import { useParams, Link } from 'react-router-dom';
-import { api } from '../api/client';
+import { api, apiRaw } from '../api/client';
 import type { Job, LogLine, SyncPair } from '../api/client';
 import { Badge } from '@/components/ui/Badge';
 import { Button } from '@/components/ui/Button';
@@ -37,12 +37,12 @@ import { formatDuration } from '@/lib/utils';
 import { cn } from '@/lib/utils';
 
 interface SSEProgress {
-  fileBytes: number;
+  file_bytes: number;
   pct: number;
-  speedBps: number;
-  etaSeconds: number;
-  xfrDone: number;
-  xfrTotal: number;
+  speed_bps: number;
+  eta_seconds: number;
+  xfr_done: number;
+  xfr_total: number;
 }
 
 interface SSEEvent {
@@ -157,12 +157,33 @@ export default function JobDetail() {
     }
   }
 
-  function downloadLog() {
+async function downloadLog() {
+    try {
+      const resp = await apiRaw(`/api/jobs/${id}/log/download`);
+      if (resp.ok && resp.body) {
+        const blob = await resp.blob();
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = `job-${id}.log`;
+        document.body.appendChild(a);
+        a.click();
+        document.body.removeChild(a);
+        URL.revokeObjectURL(url);
+      } else {
+        fallbackDownload();
+      }
+    } catch {
+      fallbackDownload();
+    }
+  }
+
+  function fallbackDownload() {
     const allLines = [
       ...logs.map(l => `[${l.timestamp}] [${l.stream}] ${l.content}`),
       ...liveLines.map(l => `[LIVE] [${l.stream}] ${l.text}`),
     ];
-    const blob = new Blob([allLines.join('\n')], { type: 'text/plain' });
+    const blob = new Blob(allLines as string[], { type: 'text/plain' });
     const url = URL.createObjectURL(blob);
     const a = document.createElement('a');
     a.href = url;
@@ -553,13 +574,13 @@ function TransferProgress({
 
             <div className="flex justify-between text-xs text-fg-muted">
               <span className="font-mono">
-                xfr#{(progress.xfrDone).toLocaleString()}/{progress.xfrTotal > 0 ? progress.xfrTotal.toLocaleString() : '?'}
+                xfr#{(progress.xfr_done).toLocaleString()}/{progress.xfr_total > 0 ? progress.xfr_total.toLocaleString() : '?'}
               </span>
               <span className="font-mono">
-                {formatSpeed(progress.speedBps)}
+                {formatSpeed(progress.speed_bps)}
               </span>
               <span className="font-mono">
-                ETA {progress.etaSeconds > 0 ? `${Math.floor(progress.etaSeconds / 60)}m ${progress.etaSeconds % 60}s` : '-'}
+                ETA {progress.eta_seconds > 0 ? `${Math.floor(progress.eta_seconds / 60)}m ${progress.eta_seconds % 60}s` : '-'}
               </span>
             </div>
           </>