feat(tasks): unify saved tasks on ssh_tasks services

- Add shared task_runner.run_saved_task helper used by routers/tasks.py and
  widgets/sources.py SshTaskWidgetSource.
- Saved tasks now target ssh_tasks service instances via default_service_id;
  the legacy default_machine_id and saved_task_runs are removed.
- Actions page lists ssh_tasks services for default and run-time selection.
- Update types, API client, hooks, tests, docs, and changelog.

Backend tests: 222 passed. Frontend lint/build/test: clean (71 passed).

backend/src/media_library_viewer_api/widgets/sources.py

@@ -12,21 +12,18 @@ from __future__ import annotations
 
 import asyncio
 import logging
-import shlex
-import time
 from dataclasses import dataclass, field
 from typing import Any, Protocol
 
 import requests
 
 from media_library_viewer_api.clients.jellyfin import JellyfinClient
-from media_library_viewer_api.clients.ssh import RemoteSSHClient
-from media_library_viewer_api.config import get_settings
 from media_library_viewer_api.domain.dashboard import (
     _map_sessions_to_activity_rows,
     build_backup_dashboard_summary,
 )
 from media_library_viewer_api.services.settings_store import SettingsStore, get_settings_store
+from media_library_viewer_api.services.task_runner import run_saved_task
 
 logger = logging.getLogger(__name__)
 
@@ -200,51 +197,17 @@ class SshTaskWidgetSource:
             if not task.get("enabled", True):
                 return {"error": "Task is disabled"}
 
-            client = _build_ssh_client(store, service)
             timeout = int(service.config.get("timeout_seconds") or 30)
-            task_type = str(task.get("task_type") or "shell").lower()
-            command = str(task.get("content") or "")
-            if task_type == "python":
-                command = f"python3 -c {shlex.quote(command)}"
-            elif task_type != "shell":
-                return {"error": f"Unknown task type: {task_type}"}
-
-            start = time.perf_counter()
             result = await asyncio.wait_for(
-                asyncio.to_thread(client.run, command, timeout),
+                asyncio.to_thread(run_saved_task, store, task, service),
                 timeout=timeout,
             )
-            duration_ms = int((time.perf_counter() - start) * 1000)
-            stdout = result.stdout or ""
-            stderr = result.stderr or ""
-            store.record_service_task_run(
-                {
-                    "task_id": task_id,
-                    "service_id": service.id,
-                    "status": "success" if result.exit_status == 0 else "failure",
-                    "exit_status": result.exit_status,
-                    "duration_ms": duration_ms,
-                    "stdout_tail": stdout,
-                    "stderr_tail": stderr,
-                    "error": "" if result.exit_status == 0 else (stderr or stdout or "Task failed"),
-                }
-            )
-            return {"exit_status": result.exit_status, "stdout": stdout, "stderr": stderr}
+            return {"exit_status": result.exit_status, "stdout": result.stdout, "stderr": result.stderr}
         except asyncio.TimeoutError:
             _record_timeout(service, config, timeout)
             return {"error": "Widget data fetch timed out"}
         except Exception as exc:
             logger.exception("ssh_task adapter failed")
-            store = get_settings_store()
-            store.record_service_task_run(
-                {
-                    "task_id": str(config.get("task_id") or ""),
-                    "service_id": service.id if service else "",
-                    "status": "error",
-                    "duration_ms": 0,
-                    "error": str(exc)[:1000],
-                }
-            )
             return {"error": f"SSH task failed: {exc}"}
 
 
@@ -264,37 +227,6 @@ def _record_timeout(service: ServiceRecord | None, config: dict[str, Any], timeo
         logger.exception("failed to record ssh task timeout")
 
 
-def _build_ssh_client(store: SettingsStore, service: ServiceRecord) -> RemoteSSHClient:
-    """Build an SSH client from an ssh_tasks service instance + referenced key."""
-    config = service.config
-    host = str(config.get("host") or "").strip()
-    username = str(config.get("username") or "").strip()
-    if not host or not username:
-        raise ValueError("SSH task service is missing host or username")
-
-    settings = get_settings()
-    private_key = ""
-    key_passphrase = ""
-    ssh_key_id = str(config.get("ssh_key_id") or "").strip()
-    if ssh_key_id:
-        ssh_key = store.get_ssh_key(ssh_key_id)
-        if ssh_key:
-            private_key = str(ssh_key.get("private_key") or "")
-            key_passphrase = str(ssh_key.get("passphrase") or "")
-    # Service-level passphrase secret takes precedence.
-    key_passphrase = str(service.secrets.get("passphrase") or "") or key_passphrase
-
-    return RemoteSSHClient(
-        host=host,
-        username=username,
-        port=int(config.get("port") or 22),
-        private_key=private_key or None,
-        private_key_passphrase=key_passphrase or None,
-        known_hosts_path=str(settings.ssh_known_hosts_file),
-        timeout=int(config.get("timeout_seconds") or 30),
-    )
-
-
 # ---------------------------------------------------------------------------
 # Registries
 # ---------------------------------------------------------------------------