Hub-and-Spoke Umbau: Multi-Tenant Zentrale + Satellite-Agent

- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit
- Satellite-API: heartbeat, poll (atomares Claiming), logs, result,
  scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht)
- Job-Queue: pending/claimed/running/success/failed + Stale-Janitor
- Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab
- Credentials bleiben lokal: nur symbolische credential_ref zentral
- Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich
- Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket
- Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner
- Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert

backend/app/core/security.py

@@ -1,58 +1,21 @@
-"""Security helpers: Fernet credential encryption, JWT issue/verify, password hashing."""
+"""Security helpers: JWT issue/verify, password hashing.
+
+No credential encryption here - target-system credentials live exclusively
+on the satellites, never in the central database.
+"""
 
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
 from typing import Any
 
 import bcrypt
-from cryptography.fernet import Fernet, InvalidToken
 from jose import JWTError, jwt
 
 from app.core.config import get_settings
-from app.core.exceptions import CredentialDecryptionError, InvalidTokenError
+from app.core.exceptions import InvalidTokenError
 
 settings = get_settings()
 
-# ---------------------------------------------------------------------------
-# Fernet encryption for stored credentials
-# ---------------------------------------------------------------------------
-
-_fernet: Fernet | None = None
-
-
-def _get_fernet() -> Fernet:
-    global _fernet
-    if _fernet is None:
-        key = settings.encryption_key
-        if not key:
-            # Dev fallback: derive a valid fernet key from SECRET_KEY
-            import base64
-            import hashlib
-
-            key = base64.urlsafe_b64encode(
-                hashlib.sha256(settings.secret_key.encode()).digest()
-            ).decode()
-        _fernet = Fernet(key.encode() if isinstance(key, str) else key)
-    return _fernet
-
-
-def encrypt(plaintext: str) -> str:
-    """Encrypt a secret for at-rest storage."""
-    return _get_fernet().encrypt(plaintext.encode()).decode()
-
-
-def decrypt(token: str) -> str:
-    """Decrypt a stored secret. Raises CredentialDecryptionError on failure."""
-    try:
-        return _get_fernet().decrypt(token.encode()).decode()
-    except InvalidToken as exc:
-        raise CredentialDecryptionError("Stored credential cannot be decrypted") from exc
-
-
-# ---------------------------------------------------------------------------
-# Password hashing
-# ---------------------------------------------------------------------------
-
 
 def hash_password(password: str) -> str:
     # bcrypt hard limit: 72 bytes
@@ -66,11 +29,6 @@ def verify_password(plain: str, hashed: str) -> bool:
         return False
 
 
-# ---------------------------------------------------------------------------
-# JWT (RS256 with key files, HS256 fallback for dev without keys)
-# ---------------------------------------------------------------------------
-
-
 def _read_key(path: str) -> str | None:
     p = Path(path)
     return p.read_text() if p.exists() else None