feat: complete SyncServer implementation

Full-stack Go monolith with embedded React frontend for orchestrating
rsync-over-SSH file synchronization with Wake-on-LAN support.

Features:
- JWT auth (HS256) with bcrypt password hashing
- CRUD for machines (with WoL config) and sync_pairs
- Ed25519 SSH key generation and known_hosts management
- WoL magic packet sender + TCP-connect waiter with backoff
- Sync engine: rsync subprocess, per-pair job queue, progress parsing
- Homebrew cron parser for scheduled syncs
- SSE stream for live job status (queued/waking_up/running/success/failed)
- React+TS+Vite+Tailwind SPA embedded via embed.FS
- Debian packaging with systemd unit, postinst/prerm/postrm

Tech stack:
- Go 1.22+ (CGO_ENABLED=0, pure SQLite via modernc.org/sqlite)
- chi router for HTTP API
- TypeScript + React 18 + Tailwind CSS frontend
- Cross-compiled to Linux amd64 for Proxmox LXC deployment

Tests: wol (MAC parsing, magic packet), syncengine/queue, scheduler/cron

internal/api/router.go

@@ -0,0 +1,102 @@
+package api
+
+import (
+	"database/sql"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+	"github.com/syncserver/internal/auth"
+	"github.com/syncserver/internal/config"
+	"github.com/syncserver/internal/sshmanager"
+	"github.com/syncserver/internal/syncengine"
+	"github.com/syncserver/internal/webui"
+)
+
+type Server struct {
+	router *chi.Mux
+	cfg    *config.Config
+	engine *syncengine.Engine
+}
+
+func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Server {
+	auth.InitJWTManager(cfg.Auth.JWTSecret, cfg.Auth.JWTExpiryH)
+
+	r := chi.NewRouter()
+	r.Use(middleware.RequestID)
+	r.Use(middleware.RealIP)
+	r.Use(middleware.Logger)
+	r.Use(middleware.Recoverer)
+
+	s := &Server{router: r, cfg: cfg, engine: engine}
+
+	authHandler := NewAuthHandler(db)
+	machineHandler := NewMachineHandler(db)
+	syncPairHandler := NewSyncPairHandler(db)
+	jobHandler := NewJobHandler(db, engine)
+	sseHandler := NewSSEHandler(engine)
+
+	r.Route("/api", func(r chi.Router) {
+		r.Route("/auth", func(r chi.Router) {
+			r.Post("/login", authHandler.Login)
+			r.Post("/logout", authHandler.Logout)
+			r.With(auth.RequireAuth).Get("/me", authHandler.Me)
+		})
+
+		r.With(auth.RequireAuth).Route("/machines", func(r chi.Router) {
+			r.Get("/", machineHandler.List)
+			r.Post("/", machineHandler.Create)
+			r.Get("/{id}", machineHandler.Get)
+			r.Put("/{id}", machineHandler.Update)
+			r.Delete("/{id}", machineHandler.Delete)
+		})
+
+		r.With(auth.RequireAuth).Route("/sync-pairs", func(r chi.Router) {
+			r.Get("/", syncPairHandler.List)
+			r.Post("/", syncPairHandler.Create)
+			r.Get("/{id}", syncPairHandler.Get)
+			r.Put("/{id}", syncPairHandler.Update)
+			r.Delete("/{id}", syncPairHandler.Delete)
+			r.Post("/{id}/run", jobHandler.TriggerRun)
+		})
+
+		r.With(auth.RequireAuth).Route("/jobs", func(r chi.Router) {
+			r.Get("/", jobHandler.List)
+			r.Get("/{id}", jobHandler.Get)
+			r.Post("/{id}/cancel", jobHandler.Cancel)
+			r.Get("/{id}/log", jobHandler.StreamLog)
+		})
+
+		r.With(auth.RequireAuth).Get("/jobs/stream", sseHandler.Stream)
+
+		r.With(auth.RequireAuth).Get("/settings/pubkey", func(w http.ResponseWriter, r *http.Request) {
+			_, _, pubKey, _ := sshmanager.EnsureServerKey(cfg.SSHDir())
+			w.Header().Set("Content-Type", "text/plain")
+			w.Write([]byte(pubKey))
+		})
+	})
+
+	r.Get("/health", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("ok"))
+	}))
+
+	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
+		if _, ok := webui.DistFS.Open("dist" + r.URL.Path); ok == nil {
+			http.FileServer(http.FS(webui.DistFS)).ServeHTTP(w, r)
+			return
+		}
+		data, err := webui.DistFS.ReadFile("dist/index.html")
+		if err != nil {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		w.Header().Set("Content-Type", "text/html")
+		w.Write(data)
+	})
+
+	return s
+}
+
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	s.router.ServeHTTP(w, r)
+}