Add SSH key management, job history persistence, and live streaming

- SSH key management: generate ed25519 keypairs or import public keys
  from UI (/ssh-keys), per-machine key selection in Machines form,
  one-time private key download with hash verification
- Fix engine to use machine-specific SSH key (was hardcoded to server key)
- Job log persistence: write to job_logs table (DB) with batched inserts,
  buffer of 50 lines; GetAllFiltered with status/pair/date range filters
- EventBus refactor: per-job subscriber channels, global channel, non-blocking
- SSE endpoints: /jobs/stream (all), /jobs/:id/log/stream (per-job live)
- JobDetail page: live log streaming, auto-scroll, cancel, duration
- JobHistory: filters (pair, status, date range), pagination, link to detail
- Cleanup scheduler: daily purge of job_logs and finished jobs older than
  SYNCSERVER_RETENTION_DAYS (default 30)
- Migration 0002: indexes on job_logs(job_id), jobs(status,created_at),
  jobs(sync_pair_id)

internal/api/handlers_ws.go

@@ -18,11 +18,51 @@ func NewSSEHandler(engine *syncengine.Engine) *SSEHandler {
 	return &SSEHandler{engine: engine}
 }
 
-func (h *SSEHandler) Stream(w http.ResponseWriter, r *http.Request) {
+func (h *SSEHandler) StreamAll(w http.ResponseWriter, r *http.Request) {
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "SSE not supported", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no")
+	flusher.Flush()
+
+	if h.engine == nil {
+		return
+	}
+
+	events, unsub := h.engine.SubscribeGlobal()
+	defer unsub()
+
+	for {
+		select {
+		case evt := <-events:
+			data, _ := json.Marshal(evt)
+			fmt.Fprintf(w, "event: %s\ndata: %s\n\n", evt.Type, data)
+			flusher.Flush()
+		case <-r.Context().Done():
+			return
+		case <-time.After(30 * time.Second):
+			fmt.Fprintf(w, ": keepalive\n\n")
+			flusher.Flush()
+		}
+	}
+}
+
+func (h *SSEHandler) StreamJob(w http.ResponseWriter, r *http.Request) {
 	jobIDStr := r.URL.Query().Get("job_id")
-	var filterJobID int64
-	if jobIDStr != "" {
-		filterJobID, _ = strconv.ParseInt(jobIDStr, 10, 64)
+	if jobIDStr == "" {
+		http.Error(w, "job_id required", http.StatusBadRequest)
+		return
+	}
+	jobID, err := strconv.ParseInt(jobIDStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid job_id", http.StatusBadRequest)
+		return
 	}
 
 	flusher, ok := w.(http.Flusher)
@@ -35,27 +75,23 @@ func (h *SSEHandler) Stream(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-cache")
 	w.Header().Set("Connection", "keep-alive")
 	w.Header().Set("X-Accel-Buffering", "no")
-
 	flusher.Flush()
 
 	if h.engine == nil {
 		return
 	}
 
-	events := h.engine.Events()
+	events, unsub := h.engine.SubscribeJob(jobID)
+	defer unsub()
+
 	for {
 		select {
 		case evt := <-events:
-			if filterJobID != 0 && evt.JobID != filterJobID {
-				continue
-			}
 			data, _ := json.Marshal(evt)
 			fmt.Fprintf(w, "event: %s\ndata: %s\n\n", evt.Type, data)
 			flusher.Flush()
-
 		case <-r.Context().Done():
 			return
-
 		case <-time.After(30 * time.Second):
 			fmt.Fprintf(w, ": keepalive\n\n")
 			flusher.Flush()