Hub-and-Spoke Umbau: Multi-Tenant Zentrale + Satellite-Agent

- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit
- Satellite-API: heartbeat, poll (atomares Claiming), logs, result,
  scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht)
- Job-Queue: pending/claimed/running/success/failed + Stale-Janitor
- Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab
- Credentials bleiben lokal: nur symbolische credential_ref zentral
- Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich
- Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket
- Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner
- Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert

.env.example

@@ -1,49 +1,38 @@
-# Insight Updater - Environment Template
+# Insight Updater - Environment Template (Zentrale)
 # Copy to .env and fill in secrets
+# Hinweis: WinRM/SSH/Credentials sind in den Satellite gewandert (satellite/config.yaml)
 
 # =============================================================================
 # CORE APPLICATION
 # =============================================================================
 APP_ENV=development
 SECRET_KEY=change-me-min-32-characters-random
-ENCRYPTION_KEY=change-me-32-bytes-base64-encoded
 JWT_ALGORITHM=RS256
 JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
 JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
 JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
 JWT_REFRESH_TOKEN_EXPIRE_DAYS=7
 
+# Initialer Admin (nur beim ersten Start, wenn keine User existieren)
+ADMIN_INITIAL_PASSWORD=admin
+
 # =============================================================================
 # DATABASE
 # =============================================================================
 # Development: SQLite (file-based, zero config)
 DATABASE_URL=sqlite+aiosqlite:///./data/app.db
 
-# Production: PostgreSQL (uncomment and configure)
+# Production: PostgreSQL
 # DATABASE_URL=postgresql+asyncpg://updater:secure-password@db:5432/insight_updater
 DB_NAME=insight_updater
 DB_USER=updater
 DB_PASSWORD=change-me-db-password
 
 # =============================================================================
-# REDIS (for Socket.io pub/sub, caching, rate limiting)
+# JOBS
 # =============================================================================
-REDIS_URL=redis://redis:6379/0
-
-# =============================================================================
-# WINRM CONFIGURATION
-# =============================================================================
-WINRM_TRANSPORT=ntlm          # ntlm | kerberos | credssp
-WINRM_CERT_VALIDATION=ignore  # ignore | validate
-WINRM_OPERATION_TIMEOUT=60
-WINRM_READ_TIMEOUT=120
-WINRM_KERBEROS_DELEGATION=true
-
-# =============================================================================
-# SSH CONFIGURATION
-# =============================================================================
-SSH_TIMEOUT=30
-SSH_KEY_PATH=/app/keys/ssh_host_key  # optional host key for SSH server
+# Sekunden ohne Satellite-Report, bevor ein claimed/running Job als failed gilt
+JOB_STALE_TIMEOUT=3600
 
 # =============================================================================
 # LDAP / ACTIVE DIRECTORY (STUB - prepared for future implementation)
@@ -54,15 +43,11 @@ LDAP_BIND_DN=CN=svc_updater,OU=Services,DC=insight,DC=local
 LDAP_BIND_PASSWORD=
 LDAP_USER_SEARCH_BASE=OU=Users,DC=insight,DC=local
 LDAP_USER_FILTER=(sAMAccountName={username})
-LDAP_GROUP_SEARCH_BASE=OU=Groups,DC=insight,DC=local
-LDAP_GROUP_FILTER=(member={user_dn})
-LDAP_CA_CERT_PATH=/app/certs/ldap-ca.pem
 
 # =============================================================================
 # FRONTEND (injected at build time via Vite)
 # =============================================================================
 VITE_API_URL=http://localhost:8000
-VITE_WS_URL=ws://localhost:8000
 VITE_APP_TITLE=Insight Updater
 
 # =============================================================================
@@ -81,8 +66,6 @@ DOMAIN=updater.insight-it.de
 # =============================================================================
 # EXTERNAL SERVICES
 # =============================================================================
-# Vaultwarden (for CI/CD secrets)
 VAULTWARDEN_URL=https://p.hartmannsche.cloud
-# Gitea
 GITEA_URL=https://gitea.insight-it.de
-GITEA_REPO=b0rbor4d/insight-updater
+GITEA_REPO=b0rbor4d/insight-updater