Fix SSH public key format: use ssh.MarshalAuthorizedKey

Bug: raw ed25519.PublicKey bytes were stored directly instead of
OpenSSH authorized-key format (ssh-ed25519 AAAA... label).

Fixes:
- internal/sshmanager/fingerprint.go: GenerateKeyPair now uses
  ssh.NewPublicKey + ssh.MarshalAuthorizedKey
- internal/sshmanager/keys.go: EnsureServerKey uses same fix; also
  regenerates .pub file from private key if stored value is corrupt
- internal/sshmanager/fingerprint.go: add MarshalED25519PublicKey,
  PublicKeyFromPrivateKeyFile, RegeneratePublicKeyFromPrivateKeyFile
- internal/models/sshkey.go: add UpdatePublicKey
- internal/api/handlers_sshkeys.go: List+Get recover existing DB
  records with corrupt public keys by regenerating from private key
  file and updating the DB

Also adds golang.org/x/crypto/ssh dependency via go mod tidy.

internal/sshmanager/keys.go

@@ -9,6 +9,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"golang.org/x/crypto/ssh"
 )
 
 const ServerKeyLabel = "server"
@@ -39,7 +41,11 @@ func EnsureServerKey(sshDir string) (privPath, pubPath string, pubKey string, er
 		}
 		pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
 
-		pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), "syncserver")
+		sshPubKey, err := ssh.NewPublicKey(pub)
+		if err != nil {
+			return "", "", "", fmt.Errorf("wrapping public key: %w", err)
+		}
+		pubKey = strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshPubKey))) + " syncserver"
 		if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
 			return "", "", "", fmt.Errorf("writing public key: %w", err)
 		}
@@ -52,7 +58,18 @@ func EnsureServerKey(sshDir string) (privPath, pubPath string, pubKey string, er
 	if err != nil {
 		return "", "", "", fmt.Errorf("reading public key: %w", err)
 	}
-	return privPath, pubPath, strings.TrimSpace(string(data)), nil
+	pubKey = strings.TrimSpace(string(data))
+	if _, err := Fingerprint(pubKey); err != nil {
+		sshPubKey, err := PublicKeyFromPrivateKeyFile(privPath)
+		if err != nil {
+			return "", "", "", fmt.Errorf("recovering public key: %w", err)
+		}
+		pubKey = sshPubKey + " syncserver"
+		if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
+			return "", "", "", fmt.Errorf("rewriting public key: %w", err)
+		}
+	}
+	return privPath, pubPath, pubKey, nil
 }
 
 func ReadPrivateKey(path string) ([]byte, error) {