feat: add Deploy Keys function to Machines UI

- sshmanager/deploy.go: new DeployKeysToMachine function that uploads
  private keys, populates known_hosts via ssh-keyscan, and adds server
  pub key to authorized_keys on remote machines
- handlers_machines.go: new DeployKeys handler with auto-detection of
  keys needed per sync pair (source->dest uploads dest key, dest->source
  uploads source key)
- router.go: POST /machines/{id}/deploy-keys route
- client.ts: deployKeys() API method
- Machines.tsx: Deploy Keys button + modal with result display

internal/api/handlers_machines.go

@@ -6,12 +6,14 @@ import (
 	"encoding/json"
 	"log/slog"
 	"net/http"
+	"os"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"time"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/syncserver/internal/config"
 	"github.com/syncserver/internal/models"
 	"github.com/syncserver/internal/sshmanager"
 	"github.com/syncserver/internal/syncengine"
@@ -21,10 +23,11 @@ import (
 type MachineHandler struct {
 	db     *sql.DB
 	engine *syncengine.Engine
+	cfg    *config.Config
 }
 
-func NewMachineHandler(db *sql.DB, engine *syncengine.Engine) *MachineHandler {
-	return &MachineHandler{db: db, engine: engine}
+func NewMachineHandler(db *sql.DB, engine *syncengine.Engine, cfg *config.Config) *MachineHandler {
+	return &MachineHandler{db: db, engine: engine, cfg: cfg}
 }
 
 var macRegex = regexp.MustCompile(`^([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$`)
@@ -318,6 +321,118 @@ func (h *MachineHandler) ApproveFingerprint(w http.ResponseWriter, r *http.Reque
 	writeJSON(w, machineToResp(*m))
 }
 
+func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	repo := models.NewMachineRepository(h.db)
+	m, err := repo.GetByID(id)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "machine not found")
+		return
+	}
+	if err != nil {
+		slog.Error("failed to fetch machine", "id", id, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch machine")
+		return
+	}
+
+	var req struct {
+		KnownHostsHost    string `json:"known_hosts_host"`
+		IncludeServerKey  bool   `json:"include_server_key"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	serverKeyPath := h.cfg.SSHDir() + "/id_ed25519"
+	serverPubKeyPath := h.cfg.SSHDir() + "/id_ed25519.pub"
+
+	if m.SSHKeyID != nil {
+		sshKeyRepo := models.NewSSHKeyRepository(h.db)
+		sshKey, err := sshKeyRepo.GetByID(*m.SSHKeyID)
+		if err == nil && sshKey.PrivateKeyPath != "" {
+			serverKeyPath = sshKey.PrivateKeyPath
+		}
+	}
+
+	serverPubKey := ""
+	if req.IncludeServerKey {
+		data, err := os.ReadFile(serverPubKeyPath)
+		if err == nil {
+			serverPubKey = string(data)
+		}
+	}
+
+	pairRepo := models.NewSyncPairRepository(h.db)
+	allPairs, err := pairRepo.GetAll()
+	if err != nil {
+		slog.Warn("failed to fetch sync pairs for auto-detect", "error", err)
+	}
+
+	var keys []sshmanager.DeployKey
+
+	for _, pair := range allPairs {
+		if pair.SourceMachineID != nil && *pair.SourceMachineID == m.ID {
+			if pair.DestMachineID != nil {
+				destMachine, err := repo.GetByID(*pair.DestMachineID)
+				if err == nil && destMachine.SSHKeyID != nil {
+					skRepo := models.NewSSHKeyRepository(h.db)
+					sk, err := skRepo.GetByID(*destMachine.SSHKeyID)
+					if err == nil && sk.PrivateKeyPath != "" {
+						keys = append(keys, sshmanager.DeployKey{
+							LocalPath:  sk.PrivateKeyPath,
+							RemotePath: "/var/lib/syncserver/ssh/keys/" + filepath.Base(sk.PrivateKeyPath),
+							Mode:       0600,
+						})
+					}
+				}
+			}
+		}
+		if pair.DestMachineID != nil && *pair.DestMachineID == m.ID {
+			if pair.SourceMachineID != nil {
+				srcMachine, err := repo.GetByID(*pair.SourceMachineID)
+				if err == nil && srcMachine.SSHKeyID != nil {
+					skRepo := models.NewSSHKeyRepository(h.db)
+					sk, err := skRepo.GetByID(*srcMachine.SSHKeyID)
+					if err == nil && sk.PrivateKeyPath != "" {
+						keys = append(keys, sshmanager.DeployKey{
+							LocalPath:  sk.PrivateKeyPath,
+							RemotePath: "/var/lib/syncserver/ssh/keys/" + filepath.Base(sk.PrivateKeyPath),
+							Mode:       0600,
+						})
+					}
+				}
+			}
+		}
+	}
+
+	if len(keys) == 0 {
+		slog.Info("no keys auto-detected for machine, using empty key list", "machine", m.Name)
+	}
+
+	result, err := sshmanager.DeployKeysToMachine(
+		context.Background(),
+		serverKeyPath,
+		serverPubKey,
+		m.Host,
+		m.Port,
+		m.SSHUser,
+		keys,
+		req.KnownHostsHost,
+		req.IncludeServerKey,
+	)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	writeJSON(w, result)
+}
+
 func (h *MachineHandler) Refresh(w http.ResponseWriter, r *http.Request) {
 	if h.engine == nil {
 		writeError(w, http.StatusInternalServerError, "engine not available")

internal/api/router.go

@@ -34,7 +34,7 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 	s := &Server{router: r, cfg: cfg, engine: engine}
 
 	authHandler := NewAuthHandler(db)
-	machineHandler := NewMachineHandler(db, engine)
+	machineHandler := NewMachineHandler(db, engine, cfg)
 	syncPairHandler := NewSyncPairHandler(db)
 	jobHandler := NewJobHandler(db, engine)
 	sseHandler := NewSSEHandler(engine)
@@ -57,6 +57,7 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 			r.Post("/{id}/test-wol", machineHandler.TestWoL)
 			r.Post("/{id}/test-connection", machineHandler.TestConnection)
 			r.Post("/{id}/approve-fingerprint", machineHandler.ApproveFingerprint)
+			r.Post("/{id}/deploy-keys", machineHandler.DeployKeys)
 		})
 
 		r.With(auth.RequireAuth).Route("/sync-pairs", func(r chi.Router) {