Add SSH key management, job history persistence, and live streaming

- SSH key management: generate ed25519 keypairs or import public keys
  from UI (/ssh-keys), per-machine key selection in Machines form,
  one-time private key download with hash verification
- Fix engine to use machine-specific SSH key (was hardcoded to server key)
- Job log persistence: write to job_logs table (DB) with batched inserts,
  buffer of 50 lines; GetAllFiltered with status/pair/date range filters
- EventBus refactor: per-job subscriber channels, global channel, non-blocking
- SSE endpoints: /jobs/stream (all), /jobs/:id/log/stream (per-job live)
- JobDetail page: live log streaming, auto-scroll, cancel, duration
- JobHistory: filters (pair, status, date range), pagination, link to detail
- Cleanup scheduler: daily purge of job_logs and finished jobs older than
  SYNCSERVER_RETENTION_DAYS (default 30)
- Migration 0002: indexes on job_logs(job_id), jobs(status,created_at),
  jobs(sync_pair_id)

internal/api/dto.go

@@ -55,13 +55,39 @@ type SyncPairResponse struct {
 }
 
 type JobResponse struct {
-	ID          int64   `json:"id"`
-	SyncPairID  int64   `json:"sync_pair_id"`
-	TriggerType string  `json:"trigger_type"`
-	Status     string  `json:"status"`
-	StartedAt   *string `json:"started_at"`
-	FinishedAt  *string `json:"finished_at"`
-	LogFile    *string `json:"log_file"`
+	ID               int64   `json:"id"`
+	SyncPairID       int64   `json:"sync_pair_id"`
+	TriggerType      string  `json:"trigger_type"`
+	Status           string  `json:"status"`
+	StartedAt        *string `json:"started_at"`
+	FinishedAt       *string `json:"finished_at"`
+	LogFile          *string `json:"log_file"`
+	DurationSeconds  *int64  `json:"duration_seconds,omitempty"`
+	LogLineCount     *int64  `json:"log_line_count,omitempty"`
+}
+
+type LogLineResponse struct {
+	ID        int64  `json:"id"`
+	JobID     int64  `json:"job_id"`
+	Stream    string `json:"stream"`
+	Content   string `json:"content"`
+	Timestamp string `json:"timestamp"`
+}
+
+type SSHKeyRequest struct {
+	Label     string `json:"label"`
+	Generate  bool   `json:"generate"`
+	PublicKey string `json:"public_key"`
+}
+
+type SSHKeyResponse struct {
+	ID            int64  `json:"id"`
+	Label         string `json:"label"`
+	PublicKey     string `json:"public_key"`
+	Fingerprint   string `json:"fingerprint"`
+	InUse         bool   `json:"in_use"`
+	HasPrivateKey bool   `json:"has_private_key"`
+	CreatedAt     string `json:"created_at"`
 }
 
 type ErrorResponse struct {

internal/api/handlers_jobs.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"database/sql"
+	"fmt"
 	"net/http"
 	"os"
 	"strconv"
@@ -28,8 +29,30 @@ func (h *JobHandler) List(w http.ResponseWriter, r *http.Request) {
 		limit = 50
 	}
 
-	repo := models.NewJobRepository(h.db)
-	jobs, err := repo.GetAll(limit, offset)
+	var syncPairID *int64
+	if spidStr := r.URL.Query().Get("sync_pair_id"); spidStr != "" {
+		if spid, err := strconv.ParseInt(spidStr, 10, 64); err == nil {
+			syncPairID = &spid
+		}
+	}
+
+	status := r.URL.Query().Get("status")
+	triggerType := r.URL.Query().Get("trigger_type")
+
+	var from, to *time.Time
+	if fromStr := r.URL.Query().Get("from"); fromStr != "" {
+		if t, err := time.Parse(time.RFC3339, fromStr); err == nil {
+			from = &t
+		}
+	}
+	if toStr := r.URL.Query().Get("to"); toStr != "" {
+		if t, err := time.Parse(time.RFC3339, toStr); err == nil {
+			to = &t
+		}
+	}
+
+	repo := models.NewJobLogRepository(h.db)
+	jobs, total, err := repo.GetAllFiltered(limit, offset, syncPairID, status, triggerType, from, to)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "failed to fetch jobs")
 		return
@@ -37,8 +60,9 @@ func (h *JobHandler) List(w http.ResponseWriter, r *http.Request) {
 
 	out := make([]JobResponse, len(jobs))
 	for i, j := range jobs {
-		out[i] = jobToResp(j)
+		out[i] = jobWithStatsToResp(j)
 	}
+	w.Header().Set("X-Total-Count", fmt.Sprintf("%d", total))
 	writeJSON(w, out)
 }
 
@@ -120,30 +144,59 @@ func (h *JobHandler) TriggerRun(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, jobToResp(*j), http.StatusCreated)
 }
 
-func (h *JobHandler) StreamLog(w http.ResponseWriter, r *http.Request) {
+func (h *JobHandler) GetLog(w http.ResponseWriter, r *http.Request) {
 	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, "invalid id")
 		return
 	}
 
-	flusher, ok := w.(http.Flusher)
-	if !ok {
-		writeError(w, http.StatusInternalServerError, "streaming not supported")
+	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	if limit <= 0 {
+		limit = 1000
+	}
+
+	logRepo := models.NewJobLogRepository(h.db)
+	logs, err := logRepo.GetByJobID(id, limit, offset)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to fetch logs")
 		return
 	}
 
-	w.Header().Set("Content-Type", "text/plain")
-	w.Header().Set("Cache-Control", "no-cache")
-	w.Header().Set("Connection", "keep-alive")
-	flusher.Flush()
+	count, _ := logRepo.CountByJobID(id)
+	w.Header().Set("X-Total-Count", fmt.Sprintf("%d", count))
+	writeJSON(w, logs)
+}
+
+func (h *JobHandler) DownloadLog(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
 
 	jobRepo := models.NewJobRepository(h.db)
 	j, err := jobRepo.GetByID(id)
-	if err == nil && j.LogFile != nil {
-		data, _ := os.ReadFile(*j.LogFile)
-		w.Write(data)
-		flusher.Flush()
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to fetch job")
+		return
+	}
+
+	if j.LogFile != nil {
+		data, err := os.ReadFile(*j.LogFile)
+		if err == nil {
+			w.Header().Set("Content-Type", "text/plain")
+			w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="job-%d.log"`, id))
+			w.Write(data)
+			return
+		}
+	}
+
+	logRepo := models.NewJobLogRepository(h.db)
+	logs, _ := logRepo.GetByJobID(id, 100000, 0)
+	for _, l := range logs {
+		fmt.Fprintf(w, "[%s] %s\n", l.Timestamp.Format(time.RFC3339), l.Content)
 	}
 }
 
@@ -165,3 +218,10 @@ func jobToResp(j models.Job) JobResponse {
 	}
 	return resp
 }
+
+func jobWithStatsToResp(j models.JobWithStats) JobResponse {
+	resp := jobToResp(j.Job)
+	resp.DurationSeconds = j.DurationSeconds
+	resp.LogLineCount = &j.LogLineCount
+	return resp
+}

internal/api/handlers_sshkeys.go

@@ -0,0 +1,223 @@
+package api
+
+import (
+	"crypto/sha256"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/syncserver/internal/config"
+	"github.com/syncserver/internal/models"
+	"github.com/syncserver/internal/sshmanager"
+)
+
+type SSHKeyHandler struct {
+	db  *sql.DB
+	cfg *config.Config
+}
+
+func NewSSHKeyHandler(db *sql.DB, cfg *config.Config) *SSHKeyHandler {
+	return &SSHKeyHandler{db: db, cfg: cfg}
+}
+
+func (h *SSHKeyHandler) List(w http.ResponseWriter, r *http.Request) {
+	repo := models.NewSSHKeyRepository(h.db)
+	machineRepo := models.NewMachineRepository(h.db)
+	keys, err := repo.GetAll()
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to fetch ssh keys")
+		return
+	}
+	machines, _ := machineRepo.GetAll()
+
+	out := make([]SSHKeyResponse, len(keys))
+	for i, k := range keys {
+		inUse := false
+		for _, m := range machines {
+			if m.SSHKeyID != nil && *m.SSHKeyID == k.ID {
+				inUse = true
+				break
+			}
+		}
+		hasPriv := false
+		if _, err := os.Stat(k.PrivateKeyPath); err == nil {
+			hasPriv = true
+		}
+		fp, _ := sshmanager.Fingerprint(k.PublicKey)
+		out[i] = SSHKeyResponse{
+			ID:            k.ID,
+			Label:         k.Label,
+			PublicKey:     k.PublicKey,
+			Fingerprint:   fp,
+			InUse:         inUse,
+			HasPrivateKey: hasPriv,
+			CreatedAt:     k.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
+		}
+	}
+	writeJSON(w, out)
+}
+
+func (h *SSHKeyHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req SSHKeyRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if req.Label == "" {
+		writeError(w, http.StatusBadRequest, "label is required")
+		return
+	}
+	if !req.Generate && req.PublicKey == "" {
+		writeError(w, http.StatusBadRequest, "either generate=true or public_key is required")
+		return
+	}
+
+	keysDir := filepath.Join(h.cfg.SSHDir(), "keys")
+	if err := os.MkdirAll(keysDir, 0700); err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to create keys directory")
+		return
+	}
+
+	var pubKey, privPath, fp string
+	var err error
+
+	if req.Generate {
+		privPath, _, pubKey, fp, err = sshmanager.GenerateKeyPair(req.Label, keysDir)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, fmt.Sprintf("generating key: %v", err))
+			return
+		}
+	} else {
+		pubKey = strings.TrimSpace(req.PublicKey)
+		fp, err = sshmanager.Fingerprint(pubKey)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "invalid public key format")
+			return
+		}
+		privPath = ""
+	}
+
+	repo := models.NewSSHKeyRepository(h.db)
+	id, err := repo.Create(req.Label, privPath, pubKey)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to store ssh key")
+		return
+	}
+	w.Header().Set("Location", "/api/ssh-keys/"+strconv.FormatInt(id, 10))
+	writeJSON(w, SSHKeyResponse{
+		ID:            id,
+		Label:         req.Label,
+		PublicKey:     pubKey,
+		Fingerprint:   fp,
+		InUse:         false,
+		HasPrivateKey: privPath != "",
+	}, http.StatusCreated)
+}
+
+func (h *SSHKeyHandler) Get(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	repo := models.NewSSHKeyRepository(h.db)
+	k, err := repo.GetByID(id)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "ssh key not found")
+		return
+	}
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to fetch ssh key")
+		return
+	}
+	machineRepo := models.NewMachineRepository(h.db)
+	machines, _ := machineRepo.GetAll()
+	inUse := false
+	for _, m := range machines {
+		if m.SSHKeyID != nil && *m.SSHKeyID == k.ID {
+			inUse = true
+			break
+		}
+	}
+	hasPriv := false
+	if _, err := os.Stat(k.PrivateKeyPath); err == nil {
+		hasPriv = true
+	}
+	fp, _ := sshmanager.Fingerprint(k.PublicKey)
+	writeJSON(w, SSHKeyResponse{
+		ID:            k.ID,
+		Label:         k.Label,
+		PublicKey:     k.PublicKey,
+		Fingerprint:   fp,
+		InUse:         inUse,
+		HasPrivateKey: hasPriv,
+		CreatedAt:     k.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
+	})
+}
+
+func (h *SSHKeyHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	repo := models.NewSSHKeyRepository(h.db)
+	machineRepo := models.NewMachineRepository(h.db)
+	machines, _ := machineRepo.GetAll()
+	for _, m := range machines {
+		if m.SSHKeyID != nil && *m.SSHKeyID == id {
+			writeError(w, http.StatusConflict, "ssh key is in use by machines")
+			return
+		}
+	}
+	k, err := repo.GetByID(id)
+	if err == nil && k.PrivateKeyPath != "" {
+		os.Remove(k.PrivateKeyPath)
+		os.Remove(k.PrivateKeyPath + ".pub")
+	}
+	if err := repo.Delete(id); err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to delete ssh key")
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h *SSHKeyHandler) DownloadPrivate(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	repo := models.NewSSHKeyRepository(h.db)
+	k, err := repo.GetByID(id)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "ssh key not found")
+		return
+	}
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to fetch ssh key")
+		return
+	}
+	if k.PrivateKeyPath == "" {
+		writeError(w, http.StatusNotFound, "no private key available for this entry")
+		return
+	}
+
+	data, err := os.ReadFile(k.PrivateKeyPath)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to read private key")
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s.key"`, k.Label))
+	w.Header().Set("X-Private-Key-Hash", fmt.Sprintf("sha256:%x", sha256.Sum256(data)))
+	io.WriteString(w, string(data))
+}

internal/api/handlers_ws.go

@@ -18,11 +18,51 @@ func NewSSEHandler(engine *syncengine.Engine) *SSEHandler {
 	return &SSEHandler{engine: engine}
 }
 
-func (h *SSEHandler) Stream(w http.ResponseWriter, r *http.Request) {
+func (h *SSEHandler) StreamAll(w http.ResponseWriter, r *http.Request) {
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "SSE not supported", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no")
+	flusher.Flush()
+
+	if h.engine == nil {
+		return
+	}
+
+	events, unsub := h.engine.SubscribeGlobal()
+	defer unsub()
+
+	for {
+		select {
+		case evt := <-events:
+			data, _ := json.Marshal(evt)
+			fmt.Fprintf(w, "event: %s\ndata: %s\n\n", evt.Type, data)
+			flusher.Flush()
+		case <-r.Context().Done():
+			return
+		case <-time.After(30 * time.Second):
+			fmt.Fprintf(w, ": keepalive\n\n")
+			flusher.Flush()
+		}
+	}
+}
+
+func (h *SSEHandler) StreamJob(w http.ResponseWriter, r *http.Request) {
 	jobIDStr := r.URL.Query().Get("job_id")
-	var filterJobID int64
-	if jobIDStr != "" {
-		filterJobID, _ = strconv.ParseInt(jobIDStr, 10, 64)
+	if jobIDStr == "" {
+		http.Error(w, "job_id required", http.StatusBadRequest)
+		return
+	}
+	jobID, err := strconv.ParseInt(jobIDStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid job_id", http.StatusBadRequest)
+		return
 	}
 
 	flusher, ok := w.(http.Flusher)
@@ -35,27 +75,23 @@ func (h *SSEHandler) Stream(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-cache")
 	w.Header().Set("Connection", "keep-alive")
 	w.Header().Set("X-Accel-Buffering", "no")
-
 	flusher.Flush()
 
 	if h.engine == nil {
 		return
 	}
 
-	events := h.engine.Events()
+	events, unsub := h.engine.SubscribeJob(jobID)
+	defer unsub()
+
 	for {
 		select {
 		case evt := <-events:
-			if filterJobID != 0 && evt.JobID != filterJobID {
-				continue
-			}
 			data, _ := json.Marshal(evt)
 			fmt.Fprintf(w, "event: %s\ndata: %s\n\n", evt.Type, data)
 			flusher.Flush()
-
 		case <-r.Context().Done():
 			return
-
 		case <-time.After(30 * time.Second):
 			fmt.Fprintf(w, ": keepalive\n\n")
 			flusher.Flush()

internal/api/router.go

@@ -35,6 +35,7 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 	syncPairHandler := NewSyncPairHandler(db)
 	jobHandler := NewJobHandler(db, engine)
 	sseHandler := NewSSEHandler(engine)
+	sshKeyHandler := NewSSHKeyHandler(db, cfg)
 
 	r.Route("/api", func(r chi.Router) {
 		r.Route("/auth", func(r chi.Router) {
@@ -64,16 +65,26 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 			r.Get("/", jobHandler.List)
 			r.Get("/{id}", jobHandler.Get)
 			r.Post("/{id}/cancel", jobHandler.Cancel)
-			r.Get("/{id}/log", jobHandler.StreamLog)
+			r.Get("/{id}/log", jobHandler.GetLog)
+			r.Get("/{id}/log/download", jobHandler.DownloadLog)
+			r.Get("/{id}/log/stream", sseHandler.StreamJob)
 		})
 
-		r.With(auth.RequireAuth).Get("/jobs/stream", sseHandler.Stream)
+		r.With(auth.RequireAuth).Get("/jobs/stream", sseHandler.StreamAll)
 
 		r.With(auth.RequireAuth).Get("/settings/pubkey", func(w http.ResponseWriter, r *http.Request) {
 			_, _, pubKey, _ := sshmanager.EnsureServerKey(cfg.SSHDir())
 			w.Header().Set("Content-Type", "text/plain")
 			w.Write([]byte(pubKey))
 		})
+
+		r.With(auth.RequireAuth).Route("/ssh-keys", func(r chi.Router) {
+			r.Get("/", sshKeyHandler.List)
+			r.Post("/", sshKeyHandler.Create)
+			r.Get("/{id}", sshKeyHandler.Get)
+			r.Delete("/{id}", sshKeyHandler.Delete)
+			r.Get("/{id}/private", sshKeyHandler.DownloadPrivate)
+		})
 	})
 
 	r.Get("/health", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

internal/config/config.go

@@ -28,7 +28,8 @@ type AuthConfig struct {
 }
 
 type SchedulerConfig struct {
-	Timezone string `yaml:"timezone" env:"SYNCSERVER_SCHEDULER_TZ" default:"UTC"`
+	Timezone       string `yaml:"timezone" env:"SYNCSERVER_SCHEDULER_TZ" default:"UTC"`
+	RetentionDays  int    `yaml:"retention_days" env:"SYNCSERVER_RETENTION_DAYS" default:"30"`
 }
 
 var globalCfg *Config
@@ -42,7 +43,8 @@ func Load(configPath, dataDir, addr string) (*Config, error) {
 			JWTExpiryH: 24,
 		},
 		Scheduler: SchedulerConfig{
-			Timezone: "UTC",
+			Timezone:      "UTC",
+			RetentionDays: 30,
 		},
 	}
 

internal/db/migrations/0002_job_history.sql

@@ -0,0 +1,13 @@
+-- 0002_job_history.sql
+
+CREATE INDEX IF NOT EXISTS idx_job_logs_job_id ON job_logs(job_id);
+CREATE INDEX IF NOT EXISTS idx_jobs_status_created ON jobs(status, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_jobs_sync_pair_id ON jobs(sync_pair_id);
+
+CREATE TABLE IF NOT EXISTS cleanup_history (
+    id              INTEGER PRIMARY KEY AUTOINCREMENT,
+    deleted_before  DATETIME NOT NULL,
+    logs_purged     INTEGER NOT NULL DEFAULT 0,
+    jobs_purged     INTEGER NOT NULL DEFAULT 0,
+    executed_at     DATETIME DEFAULT CURRENT_TIMESTAMP
+);

internal/models/job.go

@@ -143,3 +143,11 @@ func (r *JobRepository) Count() (int64, error) {
 	err := r.db.QueryRow("SELECT COUNT(*) FROM jobs").Scan(&n)
 	return n, err
 }
+
+func (r *JobRepository) DeleteFinishedBefore(before time.Time) (int64, error) {
+	res, err := r.db.Exec("DELETE FROM jobs WHERE finished_at IS NOT NULL AND finished_at < ?", before)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}

internal/models/job_log.go

@@ -0,0 +1,168 @@
+package models
+
+import (
+	"database/sql"
+	"strings"
+	"time"
+)
+
+type JobLog struct {
+	ID        int64     `db:"id" json:"id"`
+	JobID     int64     `db:"job_id" json:"job_id"`
+	Stream    string    `db:"stream" json:"stream"`
+	Content   string    `db:"content" json:"content"`
+	Timestamp time.Time `db:"timestamp" json:"timestamp"`
+}
+
+type JobLogRepository struct {
+	db *sql.DB
+}
+
+func NewJobLogRepository(db *sql.DB) *JobLogRepository {
+	return &JobLogRepository{db: db}
+}
+
+func (r *JobLogRepository) InsertBatch(jobID int64, stream string, lines []string) error {
+	if len(lines) == 0 {
+		return nil
+	}
+	tx, err := r.db.Begin()
+	if err != nil {
+		return err
+	}
+	stmt, err := tx.Prepare("INSERT INTO job_logs (job_id, stream, content) VALUES (?, ?, ?)")
+	if err != nil {
+		return err
+	}
+	defer stmt.Close()
+	for _, line := range lines {
+		if _, err := stmt.Exec(jobID, stream, line); err != nil {
+			tx.Rollback()
+			return err
+		}
+	}
+	return tx.Commit()
+}
+
+func (r *JobLogRepository) GetByJobID(jobID int64, limit, offset int) ([]JobLog, error) {
+	if limit <= 0 {
+		limit = 1000
+	}
+	if limit > 10000 {
+		limit = 10000
+	}
+	rows, err := r.db.Query(`
+		SELECT id, job_id, stream, content, timestamp
+		FROM job_logs WHERE job_id = ?
+		ORDER BY id ASC LIMIT ? OFFSET ?`,
+		jobID, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var logs []JobLog
+	for rows.Next() {
+		var l JobLog
+		if err := rows.Scan(&l.ID, &l.JobID, &l.Stream, &l.Content, &l.Timestamp); err != nil {
+			return nil, err
+		}
+		logs = append(logs, l)
+	}
+	return logs, rows.Err()
+}
+
+func (r *JobLogRepository) CountByJobID(jobID int64) (int64, error) {
+	var n int64
+	err := r.db.QueryRow("SELECT COUNT(*) FROM job_logs WHERE job_id = ?", jobID).Scan(&n)
+	return n, err
+}
+
+func (r *JobLogRepository) DeleteBefore(before time.Time) (int64, error) {
+	res, err := r.db.Exec("DELETE FROM job_logs WHERE timestamp < ?", before)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
+type JobWithStats struct {
+	Job
+	DurationSeconds *int64 `db:"duration_seconds" json:"duration_seconds"`
+	LogLineCount    int64  `db:"log_line_count" json:"log_line_count"`
+}
+
+func (r *JobLogRepository) GetAllFiltered(limit, offset int, syncPairID *int64, status, triggerType string, from, to *time.Time) ([]JobWithStats, int64, error) {
+	where, args := []string{"1=1"}, []interface{}{}
+	if syncPairID != nil {
+		where = append(where, "j.sync_pair_id = ?")
+		args = append(args, *syncPairID)
+	}
+	if status != "" {
+		where = append(where, "j.status = ?")
+		args = append(args, status)
+	}
+	if triggerType != "" {
+		where = append(where, "j.trigger_type = ?")
+		args = append(args, triggerType)
+	}
+	if from != nil {
+		where = append(where, "j.created_at >= ?")
+		args = append(args, *from)
+	}
+	if to != nil {
+		where = append(where, "j.created_at <= ?")
+		args = append(args, *to)
+	}
+	whereClause := strings.Join(where, " AND ")
+
+	var total int64
+	countQuery := "SELECT COUNT(*) FROM jobs j WHERE " + whereClause
+	if err := r.db.QueryRow(countQuery, args...).Scan(&total); err != nil {
+		return nil, 0, err
+	}
+
+	query := `
+		SELECT
+			j.id, j.sync_pair_id, j.trigger_type, j.status,
+			j.started_at, j.finished_at, j.log_file, j.created_at,
+			CASE WHEN j.finished_at IS NOT NULL AND j.started_at IS NOT NULL
+				THEN (j.finished_at - j.started_at) ELSE NULL END as duration_seconds,
+			(SELECT COUNT(*) FROM job_logs WHERE job_id = j.id) as log_line_count
+		FROM jobs j
+		WHERE ` + whereClause + `
+		ORDER BY j.created_at DESC LIMIT ? OFFSET ?`
+	args = append(args, limit, offset)
+
+	rows, err := r.db.Query(query, args...)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer rows.Close()
+
+	var jobs []JobWithStats
+	for rows.Next() {
+		var j JobWithStats
+		var started, finished sql.NullTime
+		var logFile sql.NullString
+		var durationSeconds sql.NullInt64
+		if err := rows.Scan(&j.ID, &j.SyncPairID, &j.TriggerType, &j.Status,
+			&started, &finished, &logFile, &j.CreatedAt,
+			&durationSeconds, &j.LogLineCount); err != nil {
+			return nil, 0, err
+		}
+		if started.Valid {
+			j.StartedAt = &started.Time
+		}
+		if finished.Valid {
+			j.FinishedAt = &finished.Time
+		}
+		if logFile.Valid {
+			j.LogFile = &logFile.String
+		}
+		if durationSeconds.Valid {
+			j.DurationSeconds = &durationSeconds.Int64
+		}
+		jobs = append(jobs, j)
+	}
+	return jobs, total, rows.Err()
+}

internal/scheduler/scheduler.go

@@ -32,6 +32,8 @@ func New(database interface{ SQLDB() *sql.DB }, engine *syncengine.Engine, cfg *
 func (s *Scheduler) Start() {
 	s.wg.Add(1)
 	go s.run()
+	s.wg.Add(1)
+	go s.cleanupRun()
 	slog.Info("scheduler started")
 }
 
@@ -93,3 +95,46 @@ func (s *Scheduler) tick() {
 		}(jobID, sch.SyncPairID, sch.ID)
 	}
 }
+
+func (s *Scheduler) cleanupRun() {
+	defer s.wg.Done()
+	ticker := time.NewTicker(24 * time.Hour)
+	defer ticker.Stop()
+
+	s.cleanup()
+	for {
+		select {
+		case <-s.stopCh:
+			return
+		case <-ticker.C:
+			s.cleanup()
+		}
+	}
+}
+
+func (s *Scheduler) cleanup() {
+	retentionDays := s.cfg.Scheduler.RetentionDays
+	if retentionDays <= 0 {
+		return
+	}
+	before := time.Now().AddDate(0, 0, -retentionDays)
+
+	logRepo := models.NewJobLogRepository(s.db)
+	jobRepo := models.NewJobRepository(s.db)
+
+	deletedLogs, err := logRepo.DeleteBefore(before)
+	if err != nil {
+		slog.Error("cleanup: failed to purge old job logs", "error", err)
+		return
+	}
+
+	deletedJobs, err := jobRepo.DeleteFinishedBefore(before)
+	if err != nil {
+		slog.Error("cleanup: failed to purge old jobs", "error", err)
+		return
+	}
+
+	if deletedLogs > 0 || deletedJobs > 0 {
+		slog.Info("cleanup: purged old records", "logs_deleted", deletedLogs, "jobs_deleted", deletedJobs, "before", before.Format("2006-01-02"))
+	}
+}

internal/sshmanager/fingerprint.go

@@ -0,0 +1,89 @@
+package sshmanager
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func Fingerprint(publicKey string) (string, error) {
+	pubKey := strings.TrimSpace(publicKey)
+	parts := strings.Fields(pubKey)
+	if len(parts) < 2 {
+		return "", fmt.Errorf("invalid public key format")
+	}
+	keyData, err := base64.StdEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", fmt.Errorf("decoding public key: %w", err)
+	}
+	if len(keyData) == ed25519.PublicKeySize {
+		h := sha256.Sum256(keyData)
+		return "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
+	}
+	h := sha256.Sum256(keyData)
+	return "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
+}
+
+func ParsePublicKey(data []byte) ([]byte, string, error) {
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, "", fmt.Errorf("no PEM block found")
+	}
+	var pubKey []byte
+	var err error
+	switch block.Type {
+	case "PUBLIC KEY":
+		pubKey = block.Bytes
+	case "OPENSSH KEY":
+		parts := strings.Fields(string(block.Bytes))
+		if len(parts) < 2 {
+			return nil, "", fmt.Errorf("invalid openssh key format")
+		}
+		pubKey, err = base64.StdEncoding.DecodeString(parts[1])
+		if err != nil {
+			return nil, "", err
+		}
+	default:
+		return nil, "", fmt.Errorf("unknown PEM type: %s", block.Type)
+	}
+	h := sha256.Sum256(pubKey)
+	return pubKey, "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
+}
+
+func GenerateKeyPair(label string, sshDir string) (privPath, pubPath, pubKey, fingerprint string, err error) {
+	if err := os.MkdirAll(sshDir, 0700); err != nil {
+		return "", "", "", "", fmt.Errorf("creating ssh dir: %w", err)
+	}
+	privPath = filepath.Join(sshDir, label+".key")
+	pubPath = privPath + ".pub"
+	if _, err := os.Stat(privPath); err == nil {
+		return "", "", "", "", fmt.Errorf("key already exists")
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return "", "", "", "", fmt.Errorf("generating ed25519 key: %w", err)
+	}
+	privFile, err := os.OpenFile(privPath, os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return "", "", "", "", fmt.Errorf("creating private key file: %w", err)
+	}
+	defer privFile.Close()
+	privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return "", "", "", "", fmt.Errorf("marshaling private key: %w", err)
+	}
+	pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
+	pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), label)
+	if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
+		return "", "", "", "", fmt.Errorf("writing public key: %w", err)
+	}
+	fp, _ := Fingerprint(pubKey)
+	return privPath, pubPath, pubKey, fp, nil
+}

internal/syncengine/engine.go

@@ -19,17 +19,18 @@ type Engine struct {
 	db       *sql.DB
 	cfg      *config.Config
 	queue    *Queue
-	eventBus chan Event
+	eventBus *EventBus
 	mu       sync.RWMutex
 	stopped  bool
 }
 
 type Event struct {
-	Type    string
-	JobID   int64
-	Status  string
-	Line    string
-	Stream  string
+	Type  string
+	JobID int64
+	Key   string
+	Value string
+	Line  string
+	Stream string
 }
 
 func New(database interface{ SQLDB() *sql.DB }, cfg *config.Config) *Engine {
@@ -37,7 +38,7 @@ func New(database interface{ SQLDB() *sql.DB }, cfg *config.Config) *Engine {
 		db:       database.SQLDB(),
 		cfg:      cfg,
 		queue:    NewQueue(),
-		eventBus: make(chan Event, 100),
+		eventBus: NewEventBus(200),
 	}
 	return e
 }
@@ -45,8 +46,12 @@ func New(database interface{ SQLDB() *sql.DB }, cfg *config.Config) *Engine {
 func (e *Engine) Start() {}
 func (e *Engine) Stop()  {}
 
-func (e *Engine) Events() <-chan Event {
-	return e.eventBus
+func (e *Engine) SubscribeJob(jobID int64) (chan Event, func()) {
+	return e.eventBus.Subscribe(jobID)
+}
+
+func (e *Engine) SubscribeGlobal() (chan Event, func()) {
+	return e.eventBus.SubscribeGlobal()
 }
 
 func (e *Engine) Run(ctx context.Context, jobID int64, pairID int64) error {
@@ -106,7 +111,7 @@ func (e *Engine) Run(ctx context.Context, jobID int64, pairID int64) error {
 	}
 
 	e.setJobStatus(jobID, "waking_up")
-	e.emit(Event{Type: "status", JobID: jobID, Status: "waking_up"})
+	e.emit(Event{Type: "status", JobID: jobID, Key: "status", Value: "waking_up"})
 
 	var targetMachine *models.Machine
 	var remotePort int
@@ -134,52 +139,103 @@ func (e *Engine) Run(ctx context.Context, jobID int64, pairID int64) error {
 			timeout := time.Duration(targetMachine.WakeTimeoutSeconds) * time.Second
 			interval := time.Duration(targetMachine.WakeCheckIntervalSeconds) * time.Second
 			if err := wol.WaitUntilReady(jobCtx, targetMachine.Host, remotePort, timeout, interval, false); err != nil {
-				e.setJobStatus(jobID, "failed")
-				e.emit(Event{Type: "status", JobID: jobID, Status: "failed", Line: err.Error()})
-				return fmt.Errorf("machine not ready: %w", err)
+		e.setJobStatus(jobID, "failed")
+		e.emit(Event{Type: "status", JobID: jobID, Key: "status", Value: "failed", Line: err.Error()})
+		return fmt.Errorf("machine not ready: %w", err)
 			}
 		}
 	}
 
 	e.setJobStatus(jobID, "running")
 	e.setJobLogFile(jobID, logPath)
-	e.emit(Event{Type: "status", JobID: jobID, Status: "running"})
+	e.emit(Event{Type: "status", JobID: jobID, Key: "status", Value: "running"})
 	slog.Info("job started", "job_id", jobID, "pair", pair.Name)
 
-	var privKey string
-	if targetMachine != nil && targetMachine.SSHKeyID != nil {
+	privKey, err := e.resolveSSHKey(targetMachine)
+	if err != nil {
+		slog.Warn("failed to resolve SSH key, using server key", "error", err)
 		privKey = filepath.Join(e.cfg.SSHDir(), "id_ed25519")
 	}
 
 	runner := NewRsyncRunner(e.cfg.SSHDir(), privKey)
+	logRepo := models.NewJobLogRepository(e.db)
+	var outBuf, errBuf []string
+	flush := func() {
+		if len(outBuf) > 0 {
+			logRepo.InsertBatch(jobID, "stdout", outBuf)
+			for _, l := range outBuf {
+				e.emit(Event{Type: "log", JobID: jobID, Stream: "stdout", Line: l})
+			}
+			outBuf = nil
+		}
+		if len(errBuf) > 0 {
+			logRepo.InsertBatch(jobID, "stderr", errBuf)
+			for _, l := range errBuf {
+				e.emit(Event{Type: "log", JobID: jobID, Stream: "stderr", Line: l})
+			}
+			errBuf = nil
+		}
+	}
+
 	onLine := func(stream, line string) {
-		e.emit(Event{Type: "log", JobID: jobID, Stream: stream, Line: line})
+		f, _ := os.OpenFile(logPath, os.O_APPEND|os.O_WRONLY, 0644)
+		if f != nil {
+			fmt.Fprintln(f, line)
+			f.Close()
+		}
+		if stream == "stdout" {
+			outBuf = append(outBuf, line)
+		} else {
+			errBuf = append(errBuf, line)
+		}
+		if len(outBuf) >= 50 || len(errBuf) >= 50 {
+			flush()
+		}
 	}
 
 	result, err := runner.Run(jobCtx, cfg, onLine)
+	flush()
+
 	if err != nil {
 		if jobCtx.Err() != nil {
-			e.setJobStatus(jobID, "cancelled")
-			e.emit(Event{Type: "status", JobID: jobID, Status: "cancelled"})
+		e.setJobStatus(jobID, "cancelled")
+			e.emit(Event{Type: "status", JobID: jobID, Key: "status", Value: "cancelled"})
 			return jobCtx.Err()
 		}
 		e.setJobStatus(jobID, "failed")
-		e.emit(Event{Type: "status", JobID: jobID, Status: "failed", Line: err.Error()})
+		e.emit(Event{Type: "status", JobID: jobID, Key: "status", Value: "failed", Line: err.Error()})
 		return fmt.Errorf("rsync error: %w", err)
 	}
 
 	if result.ExitCode != 0 {
-		e.setJobStatus(jobID, "failed")
-		e.emit(Event{Type: "status", JobID: jobID, Status: "failed", Line: result.Stderr})
+	e.setJobStatus(jobID, "failed")
+		e.emit(Event{Type: "status", JobID: jobID, Key: "status", Value: "failed", Line: result.Stderr})
 		return fmt.Errorf("rsync exited with code %d: %s", result.ExitCode, result.Stderr)
 	}
 
 	e.setJobStatus(jobID, "success")
-	e.emit(Event{Type: "status", JobID: jobID, Status: "success"})
+	e.emit(Event{Type: "status", JobID: jobID, Key: "status", Value: "success"})
 	slog.Info("job completed", "job_id", jobID, "pair", pair.Name)
+	e.persistAndClose(jobID)
 	return nil
 }
 
+func (e *Engine) persistAndClose(jobID int64) {
+	e.eventBus.CloseJobChannels(jobID)
+}
+
+func (e *Engine) resolveSSHKey(machine *models.Machine) (string, error) {
+	if machine == nil || machine.SSHKeyID == nil {
+		return filepath.Join(e.cfg.SSHDir(), "id_ed25519"), nil
+	}
+	sshKeyRepo := models.NewSSHKeyRepository(e.db)
+	sshKey, err := sshKeyRepo.GetByID(*machine.SSHKeyID)
+	if err != nil {
+		return "", fmt.Errorf("fetching ssh key: %w", err)
+	}
+	return sshKey.PrivateKeyPath, nil
+}
+
 func (e *Engine) Cancel(jobID int64, syncPairID int64) bool {
 	if e.queue.IsRunning(syncPairID) {
 		e.queue.Cancel(syncPairID)
@@ -199,11 +255,7 @@ func (e *Engine) setJobLogFile(jobID int64, path string) {
 }
 
 func (e *Engine) emit(evt Event) {
-	select {
-	case e.eventBus <- evt:
-	default:
-		slog.Warn("event bus full, dropping event", "type", evt.Type)
-	}
+	e.eventBus.Publish(evt)
 }
 
 func buildPath(path string, machine *models.Machine) string {

internal/syncengine/eventbus.go

@@ -0,0 +1,92 @@
+package syncengine
+
+import (
+	"log/slog"
+	"sync"
+)
+
+type EventBus struct {
+	subscribers map[int64]map[chan Event]struct{}
+	mu          sync.RWMutex
+	global      chan Event
+	bufferSize  int
+}
+
+func NewEventBus(bufferSize int) *EventBus {
+	return &EventBus{
+		subscribers: make(map[int64]map[chan Event]struct{}),
+		global:      make(chan Event, bufferSize),
+		bufferSize:  bufferSize,
+	}
+}
+
+func (eb *EventBus) Subscribe(jobID int64) (chan Event, func()) {
+	eb.mu.Lock()
+	defer eb.mu.Unlock()
+	if eb.subscribers[jobID] == nil {
+		eb.subscribers[jobID] = make(map[chan Event]struct{})
+	}
+	ch := make(chan Event, eb.bufferSize)
+	eb.subscribers[jobID][ch] = struct{}{}
+	unsubscribe := func() {
+		eb.mu.Lock()
+		defer eb.mu.Unlock()
+		if subs, ok := eb.subscribers[jobID]; ok {
+			delete(subs, ch)
+			if len(subs) == 0 {
+				delete(eb.subscribers, jobID)
+			}
+		}
+		close(ch)
+	}
+	return ch, unsubscribe
+}
+
+func (eb *EventBus) SubscribeGlobal() (chan Event, func()) {
+	eb.mu.RLock()
+	ch := make(chan Event, eb.bufferSize)
+	eb.mu.RUnlock()
+	go func() {
+		for evt := range eb.global {
+			select {
+			case ch <- evt:
+			default:
+				slog.Warn("global event subscriber buffer full, dropping event", "type", evt.Type)
+			}
+		}
+		close(ch)
+	}()
+	return ch, func() { close(ch) }
+}
+
+func (eb *EventBus) Publish(evt Event) {
+	eb.mu.RLock()
+	defer eb.mu.RUnlock()
+
+	if subs, ok := eb.subscribers[evt.JobID]; ok {
+		for ch := range subs {
+			select {
+			case ch <- evt:
+			default:
+				slog.Warn("job event subscriber buffer full, dropping event", "job_id", evt.JobID)
+			}
+		}
+	}
+
+	select {
+	case eb.global <- evt:
+	default:
+		slog.Warn("global event bus full, dropping event", "type", evt.Type)
+	}
+}
+
+func (eb *EventBus) CloseJobChannels(jobID int64) {
+	eb.mu.Lock()
+	defer eb.mu.Unlock()
+	if subs, ok := eb.subscribers[jobID]; ok {
+		for ch := range subs {
+			close(ch)
+		}
+		delete(eb.subscribers, jobID)
+	}
+}