Hub-and-Spoke Umbau: Multi-Tenant Zentrale + Satellite-Agent

- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit
- Satellite-API: heartbeat, poll (atomares Claiming), logs, result,
  scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht)
- Job-Queue: pending/claimed/running/success/failed + Stale-Janitor
- Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab
- Credentials bleiben lokal: nur symbolische credential_ref zentral
- Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich
- Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket
- Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner
- Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert

docker-compose.yml

@@ -1,9 +1,9 @@
 version: '3.8'
 
+# Zentrale Insight-Updater-Instanz (Hub). Satelliten laufen beim Kunden,
+# nicht hier - siehe satellite/.
+
 services:
-  # ---------------------------------------------------------------------------
-  # BACKEND - FastAPI
-  # ---------------------------------------------------------------------------
   backend:
     build:
       context: ./backend
@@ -13,14 +13,10 @@ services:
     environment:
       - APP_ENV=development
       - DATABASE_URL=sqlite+aiosqlite:///./data/app.db
-      - REDIS_URL=redis://redis:6379/0
       - SECRET_KEY=${SECRET_KEY:-dev-secret-change-me-32-chars-min}
-      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-dev-encryption-key-32-chars-base64}
       - JWT_ALGORITHM=RS256
       - JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
       - JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
-      - WINRM_TRANSPORT=ntlm
-      - WINRM_CERT_VALIDATION=ignore
       - LDAP_ENABLED=false
       - LOG_LEVEL=DEBUG
     volumes:
@@ -29,9 +25,6 @@ services:
       - ./backend/keys:/app/keys:ro
     ports:
       - "8000:8000"
-    depends_on:
-      redis:
-        condition: service_healthy
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
       interval: 10s
@@ -41,9 +34,6 @@ services:
     networks:
       - insight-updater-network
 
-  # ---------------------------------------------------------------------------
-  # FRONTEND - Vue 3 + Vite (dev) / Nginx (prod)
-  # ---------------------------------------------------------------------------
   frontend:
     build:
       context: ./frontend
@@ -52,7 +42,6 @@ services:
     container_name: insight-updater-frontend
     environment:
       - VITE_API_URL=http://localhost:8000
-      - VITE_WS_URL=ws://localhost:8000
     volumes:
       - ./frontend:/app
       - /app/node_modules
@@ -63,28 +52,7 @@ services:
     networks:
       - insight-updater-network
 
-  # ---------------------------------------------------------------------------
-  # REDIS - for WebSocket pub/sub, caching, rate limiting
-  # ---------------------------------------------------------------------------
-  redis:
-    image: redis:7-alpine
-    container_name: insight-updater-redis
-    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
-    volumes:
-      - redis-data:/data
-    ports:
-      - "6379:6379"
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-    networks:
-      - insight-updater-network
-
-  # ---------------------------------------------------------------------------
-  # POSTGRESQL (optional, for production)
-  # ---------------------------------------------------------------------------
+  # PostgreSQL (optional, fuer Produktion)
   # postgres:
   #   image: postgres:16-alpine
   #   container_name: insight-updater-postgres
@@ -94,20 +62,9 @@ services:
   #     - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
   #   volumes:
   #     - postgres-data:/var/lib/postgresql/data
-  #   ports:
-  #     - "5432:5432"
-  #   healthcheck:
-  #     test: ["CMD-SHELL", "pg_isready -U updater -d updater"]
-  #     interval: 5s
-  #     timeout: 5s
-  #     retries: 5
   #   networks:
   #     - insight-updater-network
 
-volumes:
-  redis-data:
-  # postgres-data:
-
 networks:
   insight-updater-network:
-    driver: bridge
+    driver: bridge