feat: complete SyncServer implementation

Full-stack Go monolith with embedded React frontend for orchestrating
rsync-over-SSH file synchronization with Wake-on-LAN support.

Features:
- JWT auth (HS256) with bcrypt password hashing
- CRUD for machines (with WoL config) and sync_pairs
- Ed25519 SSH key generation and known_hosts management
- WoL magic packet sender + TCP-connect waiter with backoff
- Sync engine: rsync subprocess, per-pair job queue, progress parsing
- Homebrew cron parser for scheduled syncs
- SSE stream for live job status (queued/waking_up/running/success/failed)
- React+TS+Vite+Tailwind SPA embedded via embed.FS
- Debian packaging with systemd unit, postinst/prerm/postrm

Tech stack:
- Go 1.22+ (CGO_ENABLED=0, pure SQLite via modernc.org/sqlite)
- chi router for HTTP API
- TypeScript + React 18 + Tailwind CSS frontend
- Cross-compiled to Linux amd64 for Proxmox LXC deployment

Tests: wol (MAC parsing, magic packet), syncengine/queue, scheduler/cron

internal/syncengine/queue.go

@@ -0,0 +1,63 @@
+package syncengine
+
+import (
+	"errors"
+	"sync"
+)
+
+var ErrAlreadyRunning = errors.New("job already running for this sync pair")
+
+type Queue struct {
+	mu    sync.Mutex
+	runs  map[int64]*RunInfo
+}
+
+type RunInfo struct {
+	JobID   int64
+	Cancel  func()
+}
+
+func NewQueue() *Queue {
+	return &Queue{runs: make(map[int64]*RunInfo)}
+}
+
+func (q *Queue) Enqueue(syncPairID, jobID int64, cancel func()) error {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	if _, exists := q.runs[syncPairID]; exists {
+		return ErrAlreadyRunning
+	}
+	q.runs[syncPairID] = &RunInfo{JobID: jobID, Cancel: cancel}
+	return nil
+}
+
+func (q *Queue) Dequeue(syncPairID int64) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	delete(q.runs, syncPairID)
+}
+
+func (q *Queue) IsRunning(syncPairID int64) bool {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	_, exists := q.runs[syncPairID]
+	return exists
+}
+
+func (q *Queue) GetJobID(syncPairID int64) (int64, bool) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	info, exists := q.runs[syncPairID]
+	if !exists {
+		return 0, false
+	}
+	return info.JobID, true
+}
+
+func (q *Queue) Cancel(syncPairID int64) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	if info, exists := q.runs[syncPairID]; exists && info.Cancel != nil {
+		info.Cancel()
+	}
+}