Hub-and-Spoke Umbau: Multi-Tenant Zentrale + Satellite-Agent

- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit
- Satellite-API: heartbeat, poll (atomares Claiming), logs, result,
  scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht)
- Job-Queue: pending/claimed/running/success/failed + Stale-Janitor
- Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab
- Credentials bleiben lokal: nur symbolische credential_ref zentral
- Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich
- Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket
- Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner
- Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert

backend/app/schemas/satellite.py

@@ -0,0 +1,30 @@
+"""Satellite schemas."""
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class SatelliteCreate(BaseModel):
+    customer_id: int
+    name: str = Field(min_length=1, max_length=255)
+
+
+class SatelliteRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    customer_id: int
+    name: str
+    api_key_prefix: str
+    is_active: bool
+    last_seen_at: datetime | None
+    version: str | None
+    hostname: str | None
+    created_at: datetime
+
+
+class SatelliteCreated(SatelliteRead):
+    """Returned exactly once on creation - contains the plaintext API key."""
+
+    api_key: str