Hub-and-Spoke Umbau: Multi-Tenant Zentrale + Satellite-Agent

- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit
- Satellite-API: heartbeat, poll (atomares Claiming), logs, result,
  scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht)
- Job-Queue: pending/claimed/running/success/failed + Stale-Janitor
- Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab
- Credentials bleiben lokal: nur symbolische credential_ref zentral
- Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich
- Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket
- Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner
- Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert

backend/app/core/config.py

@@ -18,7 +18,6 @@ class Settings(BaseSettings):
     app_env: str = "development"
     app_name: str = "Insight Updater"
     secret_key: str = "dev-secret-change-me-32-chars-min"
-    encryption_key: str = ""
     log_level: str = "INFO"
     log_format: str = "json"
 
@@ -29,19 +28,12 @@ class Settings(BaseSettings):
     jwt_access_token_expire_minutes: int = 30
     jwt_refresh_token_expire_days: int = 7
 
-    # Database / Redis
+    # Database
     database_url: str = "sqlite+aiosqlite:///./data/app.db"
-    redis_url: str = "redis://localhost:6379/0"
 
-    # WinRM
-    winrm_transport: str = "ntlm"
-    winrm_cert_validation: str = "ignore"
-    winrm_operation_timeout: int = 60
-    winrm_read_timeout: int = 120
-    winrm_kerberos_delegation: bool = True
-
-    # SSH
-    ssh_timeout: int = 30
+    # Jobs: a claimed/running job without satellite reports for this many
+    # seconds is considered stale and marked failed by the janitor
+    job_stale_timeout: int = 3600
 
     # LDAP (stub)
     ldap_enabled: bool = False

backend/app/core/exceptions.py

@@ -62,5 +62,10 @@ class CAUError(AppError):
     detail = "Cluster-Aware Updating operation failed"
 
 
+class ValidationError(AppError):
+    status_code = 422
+    detail = "Validation failed"
+
+
 class JobNotCancellableError(ConflictError):
     detail = "Job cannot be cancelled in its current state"

backend/app/core/security.py

@@ -1,58 +1,21 @@
-"""Security helpers: Fernet credential encryption, JWT issue/verify, password hashing."""
+"""Security helpers: JWT issue/verify, password hashing.
+
+No credential encryption here - target-system credentials live exclusively
+on the satellites, never in the central database.
+"""
 
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
 from typing import Any
 
 import bcrypt
-from cryptography.fernet import Fernet, InvalidToken
 from jose import JWTError, jwt
 
 from app.core.config import get_settings
-from app.core.exceptions import CredentialDecryptionError, InvalidTokenError
+from app.core.exceptions import InvalidTokenError
 
 settings = get_settings()
 
-# ---------------------------------------------------------------------------
-# Fernet encryption for stored credentials
-# ---------------------------------------------------------------------------
-
-_fernet: Fernet | None = None
-
-
-def _get_fernet() -> Fernet:
-    global _fernet
-    if _fernet is None:
-        key = settings.encryption_key
-        if not key:
-            # Dev fallback: derive a valid fernet key from SECRET_KEY
-            import base64
-            import hashlib
-
-            key = base64.urlsafe_b64encode(
-                hashlib.sha256(settings.secret_key.encode()).digest()
-            ).decode()
-        _fernet = Fernet(key.encode() if isinstance(key, str) else key)
-    return _fernet
-
-
-def encrypt(plaintext: str) -> str:
-    """Encrypt a secret for at-rest storage."""
-    return _get_fernet().encrypt(plaintext.encode()).decode()
-
-
-def decrypt(token: str) -> str:
-    """Decrypt a stored secret. Raises CredentialDecryptionError on failure."""
-    try:
-        return _get_fernet().decrypt(token.encode()).decode()
-    except InvalidToken as exc:
-        raise CredentialDecryptionError("Stored credential cannot be decrypted") from exc
-
-
-# ---------------------------------------------------------------------------
-# Password hashing
-# ---------------------------------------------------------------------------
-
 
 def hash_password(password: str) -> str:
     # bcrypt hard limit: 72 bytes
@@ -66,11 +29,6 @@ def verify_password(plain: str, hashed: str) -> bool:
         return False
 
 
-# ---------------------------------------------------------------------------
-# JWT (RS256 with key files, HS256 fallback for dev without keys)
-# ---------------------------------------------------------------------------
-
-
 def _read_key(path: str) -> str | None:
     p = Path(path)
     return p.read_text() if p.exists() else None