Add SSH key management, job history persistence, and live streaming

- SSH key management: generate ed25519 keypairs or import public keys
  from UI (/ssh-keys), per-machine key selection in Machines form,
  one-time private key download with hash verification
- Fix engine to use machine-specific SSH key (was hardcoded to server key)
- Job log persistence: write to job_logs table (DB) with batched inserts,
  buffer of 50 lines; GetAllFiltered with status/pair/date range filters
- EventBus refactor: per-job subscriber channels, global channel, non-blocking
- SSE endpoints: /jobs/stream (all), /jobs/:id/log/stream (per-job live)
- JobDetail page: live log streaming, auto-scroll, cancel, duration
- JobHistory: filters (pair, status, date range), pagination, link to detail
- Cleanup scheduler: daily purge of job_logs and finished jobs older than
  SYNCSERVER_RETENTION_DAYS (default 30)
- Migration 0002: indexes on job_logs(job_id), jobs(status,created_at),
  jobs(sync_pair_id)

internal/sshmanager/fingerprint.go

@@ -0,0 +1,89 @@
+package sshmanager
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func Fingerprint(publicKey string) (string, error) {
+	pubKey := strings.TrimSpace(publicKey)
+	parts := strings.Fields(pubKey)
+	if len(parts) < 2 {
+		return "", fmt.Errorf("invalid public key format")
+	}
+	keyData, err := base64.StdEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", fmt.Errorf("decoding public key: %w", err)
+	}
+	if len(keyData) == ed25519.PublicKeySize {
+		h := sha256.Sum256(keyData)
+		return "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
+	}
+	h := sha256.Sum256(keyData)
+	return "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
+}
+
+func ParsePublicKey(data []byte) ([]byte, string, error) {
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, "", fmt.Errorf("no PEM block found")
+	}
+	var pubKey []byte
+	var err error
+	switch block.Type {
+	case "PUBLIC KEY":
+		pubKey = block.Bytes
+	case "OPENSSH KEY":
+		parts := strings.Fields(string(block.Bytes))
+		if len(parts) < 2 {
+			return nil, "", fmt.Errorf("invalid openssh key format")
+		}
+		pubKey, err = base64.StdEncoding.DecodeString(parts[1])
+		if err != nil {
+			return nil, "", err
+		}
+	default:
+		return nil, "", fmt.Errorf("unknown PEM type: %s", block.Type)
+	}
+	h := sha256.Sum256(pubKey)
+	return pubKey, "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
+}
+
+func GenerateKeyPair(label string, sshDir string) (privPath, pubPath, pubKey, fingerprint string, err error) {
+	if err := os.MkdirAll(sshDir, 0700); err != nil {
+		return "", "", "", "", fmt.Errorf("creating ssh dir: %w", err)
+	}
+	privPath = filepath.Join(sshDir, label+".key")
+	pubPath = privPath + ".pub"
+	if _, err := os.Stat(privPath); err == nil {
+		return "", "", "", "", fmt.Errorf("key already exists")
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return "", "", "", "", fmt.Errorf("generating ed25519 key: %w", err)
+	}
+	privFile, err := os.OpenFile(privPath, os.O_CREATE|os.O_WRONLY, 0600)
+	if err != nil {
+		return "", "", "", "", fmt.Errorf("creating private key file: %w", err)
+	}
+	defer privFile.Close()
+	privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return "", "", "", "", fmt.Errorf("marshaling private key: %w", err)
+	}
+	pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
+	pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), label)
+	if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
+		return "", "", "", "", fmt.Errorf("writing public key: %w", err)
+	}
+	fp, _ := Fingerprint(pubKey)
+	return privPath, pubPath, pubKey, fp, nil
+}