feat: complete SyncServer implementation

Full-stack Go monolith with embedded React frontend for orchestrating
rsync-over-SSH file synchronization with Wake-on-LAN support.

Features:
- JWT auth (HS256) with bcrypt password hashing
- CRUD for machines (with WoL config) and sync_pairs
- Ed25519 SSH key generation and known_hosts management
- WoL magic packet sender + TCP-connect waiter with backoff
- Sync engine: rsync subprocess, per-pair job queue, progress parsing
- Homebrew cron parser for scheduled syncs
- SSE stream for live job status (queued/waking_up/running/success/failed)
- React+TS+Vite+Tailwind SPA embedded via embed.FS
- Debian packaging with systemd unit, postinst/prerm/postrm

Tech stack:
- Go 1.22+ (CGO_ENABLED=0, pure SQLite via modernc.org/sqlite)
- chi router for HTTP API
- TypeScript + React 18 + Tailwind CSS frontend
- Cross-compiled to Linux amd64 for Proxmox LXC deployment

Tests: wol (MAC parsing, magic packet), syncengine/queue, scheduler/cron

internal/models/sshkey.go

@@ -0,0 +1,80 @@
+package models
+
+import (
+	"database/sql"
+	"time"
+)
+
+type SSHKey struct {
+	ID              int64     `db:"id" json:"id"`
+	Label           string    `db:"label" json:"label"`
+	PrivateKeyPath  string    `db:"private_key_path" json:"-"`
+	PublicKey       string    `db:"public_key" json:"public_key"`
+	CreatedAt       time.Time `db:"created_at" json:"created_at"`
+}
+
+type SSHKeyRepository struct {
+	db *sql.DB
+}
+
+func NewSSHKeyRepository(db *sql.DB) *SSHKeyRepository {
+	return &SSHKeyRepository{db: db}
+}
+
+func (r *SSHKeyRepository) Create(label, privPath, pubKey string) (int64, error) {
+	res, err := r.db.Exec(
+		"INSERT INTO ssh_keys (label, private_key_path, public_key) VALUES (?, ?, ?)",
+		label, privPath, pubKey,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+func (r *SSHKeyRepository) GetByID(id int64) (*SSHKey, error) {
+	var k SSHKey
+	err := r.db.QueryRow(
+		"SELECT id, label, private_key_path, public_key, created_at FROM ssh_keys WHERE id = ?",
+		id,
+	).Scan(&k.ID, &k.Label, &k.PrivateKeyPath, &k.PublicKey, &k.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &k, nil
+}
+
+func (r *SSHKeyRepository) GetAll() ([]SSHKey, error) {
+	rows, err := r.db.Query(
+		"SELECT id, label, private_key_path, public_key, created_at FROM ssh_keys ORDER BY label")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var keys []SSHKey
+	for rows.Next() {
+		var k SSHKey
+		if err := rows.Scan(&k.ID, &k.Label, &k.PrivateKeyPath, &k.PublicKey, &k.CreatedAt); err != nil {
+			return nil, err
+		}
+		keys = append(keys, k)
+	}
+	return keys, rows.Err()
+}
+
+func (r *SSHKeyRepository) Delete(id int64) error {
+	_, err := r.db.Exec("DELETE FROM ssh_keys WHERE id = ?", id)
+	return err
+}
+
+func (r *SSHKeyRepository) GetServerKey() (*SSHKey, error) {
+	var k SSHKey
+	err := r.db.QueryRow(
+		"SELECT id, label, private_key_path, public_key, created_at FROM ssh_keys WHERE label = 'server' LIMIT 1",
+	).Scan(&k.ID, &k.Label, &k.PrivateKeyPath, &k.PublicKey, &k.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &k, nil
+}