feat: add Semaphore Sync job

Fetches Semaphore project inventory via Bearer auth, parses the
Ansible INI format to extract hostnames, and sets semaphore=1/0
on matching instances.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/jobs.js

@@ -66,11 +66,46 @@ async function patchmonSyncHandler(cfg) {
   return { summary: `${updated} updated of ${instances.length}` };
 }
 
+// ── Semaphore Sync ────────────────────────────────────────────────────────────
+
+async function semaphoreSyncHandler(cfg) {
+  const { api_url, api_token } = cfg;
+  if (!api_url || !api_token) throw new Error('Semaphore not configured — set API URL and token');
+
+  const res = await fetch(api_url, {
+    headers: { Authorization: `Bearer ${api_token}` },
+  });
+  if (!res.ok) throw new Error(`Semaphore API ${res.status}`);
+
+  const data = await res.json();
+  // Inventory is an Ansible INI string; extract bare hostnames
+  const hostSet = new Set(
+    (data.inventory ?? '').split('\n')
+      .map(l => l.trim())
+      .filter(l => l && !l.startsWith('[') && !l.startsWith('#') && !l.startsWith(';'))
+      .map(l => l.split(/[\s=]/)[0])
+      .filter(Boolean)
+  );
+
+  const instances = getInstances();
+  let updated = 0;
+  for (const inst of instances) {
+    const newSemaphore = hostSet.has(inst.name) ? 1 : 0;
+    if (newSemaphore !== inst.semaphore) {
+      const { id: _id, created_at: _ca, updated_at: _ua, ...instData } = inst;
+      updateInstance(inst.vmid, { ...instData, semaphore: newSemaphore });
+      updated++;
+    }
+  }
+  return { summary: `${updated} updated of ${instances.length}` };
+}
+
 // ── Registry ──────────────────────────────────────────────────────────────────
 
 const HANDLERS = {
-  tailscale_sync: tailscaleSyncHandler,
-  patchmon_sync:  patchmonSyncHandler,
+  tailscale_sync:  tailscaleSyncHandler,
+  patchmon_sync:   patchmonSyncHandler,
+  semaphore_sync:  semaphoreSyncHandler,
 };
 
 // ── Public API ────────────────────────────────────────────────────────────────