Hub-and-Spoke Umbau: Multi-Tenant Zentrale + Satellite-Agent

- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit
- Satellite-API: heartbeat, poll (atomares Claiming), logs, result,
  scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht)
- Job-Queue: pending/claimed/running/success/failed + Stale-Janitor
- Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab
- Credentials bleiben lokal: nur symbolische credential_ref zentral
- Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich
- Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket
- Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner
- Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert

backend/app/main.py

@@ -1,14 +1,13 @@
 """FastAPI application entrypoint.
 
-Mounts:
-  - REST API under /api
-  - Socket.io under /socket.io (path) -> frontend connects to ws://host/socket.io
+Central instance of the Insight Updater hub:
+  - Dashboard REST API under /api (JWT auth)
+  - Satellite agent API under /api/satellite (X-Api-Key auth)
   - /health liveness probe
 """
 
 from contextlib import asynccontextmanager
 
-import socketio
 from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
@@ -18,7 +17,6 @@ from app.core.config import get_settings
 from app.core.database import init_db
 from app.core.exceptions import AppError
 from app.core.logging import get_logger, setup_logging
-from app.websocket import sio
 
 settings = get_settings()
 logger = get_logger(__name__)
@@ -32,17 +30,15 @@ async def lifespan(app: FastAPI):  # type: ignore[no-untyped-def]
     await init_db()
     await _seed_default_admin()
 
-    # Attach Redis manager for Socket.io pub/sub (optional in dev)
-    try:
-        from socketio import AsyncRedisManager
+    import asyncio
 
-        sio.manager = AsyncRedisManager(settings.redis_url)
-        logger.info("ws.redis_manager_attached", url=settings.redis_url)
-    except Exception as exc:  # noqa: BLE001 - Redis optional for scaffold
-        logger.warning("ws.redis_unavailable", error=str(exc))
+    from app.services.janitor import run_janitor
+
+    janitor = asyncio.create_task(run_janitor(), name="job-janitor")
 
     yield
 
+    janitor.cancel()
     logger.info("app.stopping")
 
 
@@ -77,13 +73,13 @@ async def _seed_default_admin() -> None:
         logger.info("app.default_admin_created", username="admin")
 
 
-fastapi_app = FastAPI(
+app = FastAPI(
     title=settings.app_name,
-    version="0.1.0",
+    version="0.2.0",
     lifespan=lifespan,
 )
 
-fastapi_app.add_middleware(
+app.add_middleware(
     CORSMiddleware,
     allow_origins=settings.cors_origin_list,
     allow_credentials=True,
@@ -92,17 +88,14 @@ fastapi_app.add_middleware(
 )
 
 
-@fastapi_app.exception_handler(AppError)
+@app.exception_handler(AppError)
 async def app_error_handler(request: Request, exc: AppError) -> JSONResponse:  # noqa: ARG001
     return JSONResponse(status_code=exc.status_code, content={"detail": exc.detail})
 
 
-@fastapi_app.get("/health")
+@app.get("/health")
 async def health() -> dict:
-    return {"status": "ok", "env": settings.app_env, "version": "0.1.0"}
+    return {"status": "ok", "env": settings.app_env, "version": "0.2.0"}
 
 
-fastapi_app.include_router(api_router)
-
-# Combined ASGI app: FastAPI + Socket.io
-app = socketio.ASGIApp(sio, other_asgi_app=fastapi_app, socketio_path="socket.io")
+app.include_router(api_router)