Add shutdown machine feature with configurable command

Backend:
- New migration: add shutdown_command TEXT column to machines table
- Machine model updated with ShutdownCommand field (Create/GetAll/GetByID/Update)
- MachineRequest/MachineResponse DTOs updated with shutdown_command field
- New ShutdownResponse DTO
- New POST /api/machines/{id}/shutdown handler via SSH
- Refactor sshmanager/testconn.go: extract dialSSH() helper shared with shutdown.go
- New sshmanager/shutdown.go: RunRemoteCommand with 15s timeout

Frontend:
- New shutdownMachine() API helper and ShutdownResponse type in client.ts
- New shutdown_command field in MachineForm
- Power button (amber) in machines table actions
- Shutdown confirmation modal with WoL warning notice
- shutdown_command input field in machine edit/create form
- Machine interface updated with shutdown_command and last_seen_at fields

internal/api/dto.go

@@ -11,6 +11,7 @@ type MachineRequest struct {
 	BroadcastAddr               *string `json:"broadcast_addr"`
 	WakeTimeoutSeconds          int     `json:"wake_timeout_seconds"`
 	WakeCheckIntervalSeconds    int     `json:"wake_check_interval_seconds"`
+	ShutdownCommand             string  `json:"shutdown_command,omitempty"`
 }
 
 type MachineResponse struct {
@@ -30,13 +31,20 @@ type MachineResponse struct {
 	Status                      string  `json:"status"`
 	LastSeenAt                  *string `json:"last_seen_at"`
 	CreatedAt                   string  `json:"created_at"`
+	ShutdownCommand             string  `json:"shutdown_command"`
 }
 
 type TestConnectionResponse struct {
-	Success    bool    `json:"success"`
-	Output     string  `json:"output,omitempty"`
-	Error      string  `json:"error,omitempty"`
-	Fingerprint string `json:"fingerprint,omitempty"`
+	Success     bool    `json:"success"`
+	Output      string  `json:"output,omitempty"`
+	Error       string  `json:"error,omitempty"`
+	Fingerprint string  `json:"fingerprint,omitempty"`
+}
+
+type ShutdownResponse struct {
+	Success bool   `json:"success"`
+	Output  string `json:"output,omitempty"`
+	Error   string `json:"error,omitempty"`
 }
 
 type SyncPairRequest struct {

internal/api/handlers_machines.go

@@ -96,6 +96,10 @@ func (h *MachineHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	shutdownCmd := req.ShutdownCommand
+	if shutdownCmd == "" {
+		shutdownCmd = "shutdown now"
+	}
 	m := &models.Machine{
 		Name:                        req.Name,
 		Host:                        req.Host,
@@ -109,6 +113,7 @@ func (h *MachineHandler) Create(w http.ResponseWriter, r *http.Request) {
 		WakeCheckIntervalSeconds:    req.WakeCheckIntervalSeconds,
 		FingerprintConfirmed:        false,
 		Status:                      "unknown",
+		ShutdownCommand:             shutdownCmd,
 	}
 
 	repo := models.NewMachineRepository(h.db)
@@ -178,6 +183,9 @@ func (h *MachineHandler) Update(w http.ResponseWriter, r *http.Request) {
 	if req.WakeCheckIntervalSeconds > 0 {
 		existing.WakeCheckIntervalSeconds = req.WakeCheckIntervalSeconds
 	}
+	if req.ShutdownCommand != "" {
+		existing.ShutdownCommand = req.ShutdownCommand
+	}
 
 	if err := repo.Update(existing); err != nil {
 		slog.Error("failed to update machine", "id", id, "error", err)
@@ -224,6 +232,58 @@ func (h *MachineHandler) TestWoL(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]interface{}{"ok": true, "sent": 3})
 }
 
+func (h *MachineHandler) Shutdown(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	repo := models.NewMachineRepository(h.db)
+	m, err := repo.GetByID(id)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "machine not found")
+		return
+	}
+	if err != nil {
+		slog.Error("failed to fetch machine", "id", id, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch machine")
+		return
+	}
+
+	knownHostsPath, err := sshmanager.EnsureKnownHosts(filepath.Join("/var/lib/syncserver", "ssh"))
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to ensure known_hosts")
+		return
+	}
+
+	privKeyPath := filepath.Join("/var/lib/syncserver", "ssh", "id_ed25519")
+	if m.SSHKeyID != nil {
+		sshKeyRepo := models.NewSSHKeyRepository(h.db)
+		sshKey, err := sshKeyRepo.GetByID(*m.SSHKeyID)
+		if err == nil && sshKey.PrivateKeyPath != "" {
+			privKeyPath = sshKey.PrivateKeyPath
+		}
+	}
+
+	cmd := m.ShutdownCommand
+	if cmd == "" {
+		cmd = "shutdown now"
+	}
+
+	slog.Info("shutdown requested", "machine_id", id, "name", m.Name, "command", cmd)
+	result, err := sshmanager.RunRemoteCommand(
+		context.Background(), m.Host, m.Port, m.SSHUser,
+		privKeyPath, knownHostsPath, m.FingerprintConfirmed, cmd,
+	)
+
+	if err != nil {
+		slog.Error("shutdown failed", "machine_id", id, "error", err)
+		writeJSON(w, ShutdownResponse{Success: false, Error: err.Error()})
+		return
+	}
+	writeJSON(w, ShutdownResponse{Success: result.Success, Output: result.Output, Error: result.Error})
+}
+
 func (h *MachineHandler) TestConnection(w http.ResponseWriter, r *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	if err != nil {
@@ -466,6 +526,7 @@ func machineToResp(m models.Machine) MachineResponse {
 		Status:                      m.Status,
 		LastSeenAt:                  lastSeen,
 		CreatedAt:                   m.CreatedAt.Format(time.RFC3339),
+		ShutdownCommand:             m.ShutdownCommand,
 	}
 }
 

internal/api/router.go

@@ -55,6 +55,7 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 			r.Put("/{id}", machineHandler.Update)
 			r.Delete("/{id}", machineHandler.Delete)
 			r.Post("/{id}/test-wol", machineHandler.TestWoL)
+			r.Post("/{id}/shutdown", machineHandler.Shutdown)
 			r.Post("/{id}/test-connection", machineHandler.TestConnection)
 			r.Post("/{id}/approve-fingerprint", machineHandler.ApproveFingerprint)
 			r.Post("/{id}/deploy-keys", machineHandler.DeployKeys)