Fix SSH public key format: use ssh.MarshalAuthorizedKey

Bug: raw ed25519.PublicKey bytes were stored directly instead of
OpenSSH authorized-key format (ssh-ed25519 AAAA... label).

Fixes:
- internal/sshmanager/fingerprint.go: GenerateKeyPair now uses
  ssh.NewPublicKey + ssh.MarshalAuthorizedKey
- internal/sshmanager/keys.go: EnsureServerKey uses same fix; also
  regenerates .pub file from private key if stored value is corrupt
- internal/sshmanager/fingerprint.go: add MarshalED25519PublicKey,
  PublicKeyFromPrivateKeyFile, RegeneratePublicKeyFromPrivateKeyFile
- internal/models/sshkey.go: add UpdatePublicKey
- internal/api/handlers_sshkeys.go: List+Get recover existing DB
  records with corrupt public keys by regenerating from private key
  file and updating the DB

Also adds golang.org/x/crypto/ssh dependency via go mod tidy.

internal/sshmanager/fingerprint.go

@@ -11,8 +11,44 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"golang.org/x/crypto/ssh"
 )
 
+func MarshalED25519PublicKey(pub ed25519.PublicKey) (string, error) {
+	sshPubKey, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshPubKey))), nil
+}
+
+func RegeneratePublicKeyFromPrivateKeyFile(privPath, label string) (string, string, error) {
+	sshPubKey, err := PublicKeyFromPrivateKeyFile(privPath)
+	if err != nil {
+		return "", "", err
+	}
+	pubKey := sshPubKey + " " + label
+	fp, _ := Fingerprint(pubKey)
+	return pubKey, fp, nil
+}
+
+func PublicKeyFromPrivateKeyFile(privPath string) (string, error) {
+	data, err := os.ReadFile(privPath)
+	if err != nil {
+		return "", err
+	}
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return "", fmt.Errorf("no PEM block in private key file")
+	}
+	signer, err := ssh.ParsePrivateKey(data)
+	if err != nil {
+		return "", fmt.Errorf("parsing private key: %w", err)
+	}
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(signer.PublicKey()))), nil
+}
+
 func Fingerprint(publicKey string) (string, error) {
 	pubKey := strings.TrimSpace(publicKey)
 	parts := strings.Fields(pubKey)
@@ -80,7 +116,11 @@ func GenerateKeyPair(label string, sshDir string) (privPath, pubPath, pubKey, fi
 		return "", "", "", "", fmt.Errorf("marshaling private key: %w", err)
 	}
 	pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
-	pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), label)
+	sshPubKey, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return "", "", "", "", fmt.Errorf("wrapping public key: %w", err)
+	}
+	pubKey = strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshPubKey))) + " " + label
 	if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
 		return "", "", "", "", fmt.Errorf("writing public key: %w", err)
 	}

internal/sshmanager/keys.go

@@ -9,6 +9,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"golang.org/x/crypto/ssh"
 )
 
 const ServerKeyLabel = "server"
@@ -39,7 +41,11 @@ func EnsureServerKey(sshDir string) (privPath, pubPath string, pubKey string, er
 		}
 		pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
 
-		pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), "syncserver")
+		sshPubKey, err := ssh.NewPublicKey(pub)
+		if err != nil {
+			return "", "", "", fmt.Errorf("wrapping public key: %w", err)
+		}
+		pubKey = strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshPubKey))) + " syncserver"
 		if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
 			return "", "", "", fmt.Errorf("writing public key: %w", err)
 		}
@@ -52,7 +58,18 @@ func EnsureServerKey(sshDir string) (privPath, pubPath string, pubKey string, er
 	if err != nil {
 		return "", "", "", fmt.Errorf("reading public key: %w", err)
 	}
-	return privPath, pubPath, strings.TrimSpace(string(data)), nil
+	pubKey = strings.TrimSpace(string(data))
+	if _, err := Fingerprint(pubKey); err != nil {
+		sshPubKey, err := PublicKeyFromPrivateKeyFile(privPath)
+		if err != nil {
+			return "", "", "", fmt.Errorf("recovering public key: %w", err)
+		}
+		pubKey = sshPubKey + " syncserver"
+		if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
+			return "", "", "", fmt.Errorf("rewriting public key: %w", err)
+		}
+	}
+	return privPath, pubPath, pubKey, nil
 }
 
 func ReadPrivateKey(path string) ([]byte, error) {