feat: complete SyncServer implementation

Full-stack Go monolith with embedded React frontend for orchestrating
rsync-over-SSH file synchronization with Wake-on-LAN support.

Features:
- JWT auth (HS256) with bcrypt password hashing
- CRUD for machines (with WoL config) and sync_pairs
- Ed25519 SSH key generation and known_hosts management
- WoL magic packet sender + TCP-connect waiter with backoff
- Sync engine: rsync subprocess, per-pair job queue, progress parsing
- Homebrew cron parser for scheduled syncs
- SSE stream for live job status (queued/waking_up/running/success/failed)
- React+TS+Vite+Tailwind SPA embedded via embed.FS
- Debian packaging with systemd unit, postinst/prerm/postrm

Tech stack:
- Go 1.22+ (CGO_ENABLED=0, pure SQLite via modernc.org/sqlite)
- chi router for HTTP API
- TypeScript + React 18 + Tailwind CSS frontend
- Cross-compiled to Linux amd64 for Proxmox LXC deployment

Tests: wol (MAC parsing, magic packet), syncengine/queue, scheduler/cron

web/src/api/client.ts

@@ -0,0 +1,67 @@
+const BASE = '';
+
+interface ApiOptions {
+  method?: string;
+  body?: unknown;
+}
+
+export async function api<T>(path: string, opts: ApiOptions = {}): Promise<T> {
+  const { method = 'GET', body } = opts;
+  const res = await fetch(`${BASE}${path}`, {
+    method,
+    headers: body ? { 'Content-Type': 'application/json' } : {},
+    body: body ? JSON.stringify(body) : undefined,
+    credentials: 'include',
+  });
+  if (!res.ok) {
+    const err = await res.json().catch(() => ({ error: res.statusText }));
+    throw new Error((err as { error?: string }).error || 'Request failed');
+  }
+  if (res.status === 204) return undefined as T;
+  return res.json();
+}
+
+export interface User {
+  id: number;
+  username: string;
+  role: string;
+}
+
+export interface Machine {
+  id: number;
+  name: string;
+  host: string;
+  port: number;
+  ssh_user: string;
+  ssh_key_id: number | null;
+  mac_address: string | null;
+  wol_enabled: boolean;
+  broadcast_addr: string | null;
+  wake_timeout_seconds: number;
+  wake_check_interval_seconds: number;
+  fingerprint_confirmed: boolean;
+  status: string;
+}
+
+export interface SyncPair {
+  id: number;
+  name: string;
+  source_machine_id: number | null;
+  source_path: string;
+  dest_machine_id: number | null;
+  dest_path: string;
+  direction: string;
+  rsync_flags: string;
+  exclude_patterns: string;
+  enabled: boolean;
+}
+
+export interface Job {
+  id: number;
+  sync_pair_id: number;
+  trigger_type: string;
+  status: string;
+  started_at: string | null;
+  finished_at: string | null;
+  log_file: string | null;
+}