Hub-and-Spoke Umbau: Multi-Tenant Zentrale + Satellite-Agent

- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit
- Satellite-API: heartbeat, poll (atomares Claiming), logs, result,
  scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht)
- Job-Queue: pending/claimed/running/success/failed + Stale-Janitor
- Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab
- Credentials bleiben lokal: nur symbolische credential_ref zentral
- Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich
- Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket
- Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner
- Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert

docker-compose.prod.yml

@@ -14,13 +14,9 @@ services:
     environment:
       - APP_ENV=production
       - DATABASE_URL=postgresql+asyncpg://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}
-      - REDIS_URL=redis://redis:6379/0
       - SECRET_KEY=${SECRET_KEY}
-      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
       - JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
       - JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
-      - WINRM_TRANSPORT=${WINRM_TRANSPORT:-ntlm}
-      - WINRM_CERT_VALIDATION=${WINRM_CERT_VALIDATION:-validate}
       - LDAP_ENABLED=${LDAP_ENABLED:-false}
       - LDAP_URI=${LDAP_URI}
       - LDAP_BIND_DN=${LDAP_BIND_DN}
@@ -57,10 +53,6 @@ services:
       - "traefik.http.routers.updater-api.entrypoints=websecure"
       - "traefik.http.routers.updater-api.tls.certresolver=letsencrypt"
       - "traefik.http.services.updater-api.loadbalancer.server.port=8000"
-      - "traefik.http.routers.updater-ws.rule=Host(`${DOMAIN}`) && PathPrefix(`/ws`)"
-      - "traefik.http.routers.updater-ws.entrypoints=websecure"
-      - "traefik.http.routers.updater-ws.tls.certresolver=letsencrypt"
-      - "traefik.http.services.updater-ws.loadbalancer.server.port=8000"
 
   # ---------------------------------------------------------------
   # Frontend - Nginx (Production)
@@ -83,24 +75,6 @@ services:
       - "traefik.http.routers.updater-web.tls.certresolver=letsencrypt"
       - "traefik.http.services.updater-web.loadbalancer.server.port=80"
 
-  # ---------------------------------------------------------------
-  # Redis - Pub/Sub, Caching, Rate Limiting
-  # ---------------------------------------------------------------
-  redis:
-    image: redis:7-alpine
-    container_name: insight-updater-redis
-    restart: unless-stopped
-    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
-    volumes:
-      - redis-data:/data
-    networks:
-      - internal
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 3s
-      retries: 3
-
   # ---------------------------------------------------------------
   # PostgreSQL - Production Database
   # ---------------------------------------------------------------
@@ -134,5 +108,4 @@ networks:
     external: true
 
 volumes:
-  redis-data:
   pg-data: