Add SSH key management, job history persistence, and live streaming

- SSH key management: generate ed25519 keypairs or import public keys
  from UI (/ssh-keys), per-machine key selection in Machines form,
  one-time private key download with hash verification
- Fix engine to use machine-specific SSH key (was hardcoded to server key)
- Job log persistence: write to job_logs table (DB) with batched inserts,
  buffer of 50 lines; GetAllFiltered with status/pair/date range filters
- EventBus refactor: per-job subscriber channels, global channel, non-blocking
- SSE endpoints: /jobs/stream (all), /jobs/:id/log/stream (per-job live)
- JobDetail page: live log streaming, auto-scroll, cancel, duration
- JobHistory: filters (pair, status, date range), pagination, link to detail
- Cleanup scheduler: daily purge of job_logs and finished jobs older than
  SYNCSERVER_RETENTION_DAYS (default 30)
- Migration 0002: indexes on job_logs(job_id), jobs(status,created_at),
  jobs(sync_pair_id)

internal/api/router.go

@@ -35,6 +35,7 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 	syncPairHandler := NewSyncPairHandler(db)
 	jobHandler := NewJobHandler(db, engine)
 	sseHandler := NewSSEHandler(engine)
+	sshKeyHandler := NewSSHKeyHandler(db, cfg)
 
 	r.Route("/api", func(r chi.Router) {
 		r.Route("/auth", func(r chi.Router) {
@@ -64,16 +65,26 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 			r.Get("/", jobHandler.List)
 			r.Get("/{id}", jobHandler.Get)
 			r.Post("/{id}/cancel", jobHandler.Cancel)
-			r.Get("/{id}/log", jobHandler.StreamLog)
+			r.Get("/{id}/log", jobHandler.GetLog)
+			r.Get("/{id}/log/download", jobHandler.DownloadLog)
+			r.Get("/{id}/log/stream", sseHandler.StreamJob)
 		})
 
-		r.With(auth.RequireAuth).Get("/jobs/stream", sseHandler.Stream)
+		r.With(auth.RequireAuth).Get("/jobs/stream", sseHandler.StreamAll)
 
 		r.With(auth.RequireAuth).Get("/settings/pubkey", func(w http.ResponseWriter, r *http.Request) {
 			_, _, pubKey, _ := sshmanager.EnsureServerKey(cfg.SSHDir())
 			w.Header().Set("Content-Type", "text/plain")
 			w.Write([]byte(pubKey))
 		})
+
+		r.With(auth.RequireAuth).Route("/ssh-keys", func(r chi.Router) {
+			r.Get("/", sshKeyHandler.List)
+			r.Post("/", sshKeyHandler.Create)
+			r.Get("/{id}", sshKeyHandler.Get)
+			r.Delete("/{id}", sshKeyHandler.Delete)
+			r.Get("/{id}/private", sshKeyHandler.DownloadPrivate)
+		})
 	})
 
 	r.Get("/health", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {