feat: complete SyncServer implementation

Full-stack Go monolith with embedded React frontend for orchestrating
rsync-over-SSH file synchronization with Wake-on-LAN support.

Features:
- JWT auth (HS256) with bcrypt password hashing
- CRUD for machines (with WoL config) and sync_pairs
- Ed25519 SSH key generation and known_hosts management
- WoL magic packet sender + TCP-connect waiter with backoff
- Sync engine: rsync subprocess, per-pair job queue, progress parsing
- Homebrew cron parser for scheduled syncs
- SSE stream for live job status (queued/waking_up/running/success/failed)
- React+TS+Vite+Tailwind SPA embedded via embed.FS
- Debian packaging with systemd unit, postinst/prerm/postrm

Tech stack:
- Go 1.22+ (CGO_ENABLED=0, pure SQLite via modernc.org/sqlite)
- chi router for HTTP API
- TypeScript + React 18 + Tailwind CSS frontend
- Cross-compiled to Linux amd64 for Proxmox LXC deployment

Tests: wol (MAC parsing, magic packet), syncengine/queue, scheduler/cron

internal/sshmanager/keys.go

@@ -0,0 +1,68 @@
+package sshmanager
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const ServerKeyLabel = "server"
+
+func EnsureServerKey(sshDir string) (privPath, pubPath string, pubKey string, err error) {
+	if err := os.MkdirAll(sshDir, 0700); err != nil {
+		return "", "", "", fmt.Errorf("creating ssh dir: %w", err)
+	}
+
+	privPath = filepath.Join(sshDir, "id_ed25519")
+	pubPath = filepath.Join(sshDir, "id_ed25519.pub")
+
+	if _, err := os.Stat(privPath); os.IsNotExist(err) {
+		pub, priv, err := ed25519.GenerateKey(rand.Reader)
+		if err != nil {
+			return "", "", "", fmt.Errorf("generating ed25519 key: %w", err)
+		}
+
+		privFile, err := os.OpenFile(privPath, os.O_CREATE|os.O_WRONLY, 0600)
+		if err != nil {
+			return "", "", "", fmt.Errorf("creating private key file: %w", err)
+		}
+		defer privFile.Close()
+
+		privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
+		if err != nil {
+			return "", "", "", fmt.Errorf("marshaling private key: %w", err)
+		}
+		pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
+
+		pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), "syncserver")
+		if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
+			return "", "", "", fmt.Errorf("writing public key: %w", err)
+		}
+		return privPath, pubPath, pubKey, nil
+	} else if err != nil {
+		return "", "", "", fmt.Errorf("checking private key: %w", err)
+	}
+
+	data, err := os.ReadFile(pubPath)
+	if err != nil {
+		return "", "", "", fmt.Errorf("reading public key: %w", err)
+	}
+	return privPath, pubPath, strings.TrimSpace(string(data)), nil
+}
+
+func ReadPrivateKey(path string) ([]byte, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, fmt.Errorf("no PEM block found")
+	}
+	return block.Bytes, nil
+}