feat: Agent distribution with secure enrollment from the control panel

One universal Windows Agent package per version (agent_releases: version/
platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary
lives on a local release-storage volume, never in PostgreSQL). An operator
creates a pending installation (agent_enrollments) from Agents / Servidores
-> + Nova instalação, then either downloads it directly or generates a
one-time HTTPS link (short TTL, single use). Either path streams the
package plus a freshly minted enrollment.json whose token is never written
to storage in plaintext, only its SHA-256 hash. On the client host,
gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non-
HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment
token immediately after, success or failure), writes an ACL-restricted
.env with the newly issued permanent Agent token, and registers the
Windows Service without starting it (Firebird stays unconfigured on
purpose). Idempotent, replay-proof, rate-limited per IP, fully audited,
never logs a secret.

Migration 0022_agent_releases_enrollment (verified fresh-DB ==
upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION
bumped to 1.1.0 as the single source of truth across code, packages, the
release manifest and every published AgentRelease row.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/alembic/versions/0022_agent_releases_enrollment.py

@@ -0,0 +1,88 @@
+"""Agent distribution: releases + secure enrollment.
+
+agent_releases catalogs published builds of the universal Windows Agent
+package (the binary itself lives in local release storage, never in
+Postgres). agent_enrollments tracks one pending-or-completed installation
+per row, carrying two distinct hashed, single-use, short-TTL secrets: a
+download token (the shareable package link) and an enrollment token
+(embedded in the downloaded bundle, consumed once by POST /v1/agents/enroll).
+Neither secret is ever stored in plaintext.
+
+Revision ID: 0022_agent_releases_enrollment
+Revises: 0021_sso_federated_identity
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0022_agent_releases_enrollment"
+down_revision = "0021_sso_federated_identity"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        "agent_releases",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("version", sa.String(32), nullable=False),
+        sa.Column("platform", sa.String(16), nullable=False, server_default="windows"),
+        sa.Column("architecture", sa.String(16), nullable=False, server_default="x64"),
+        sa.Column("filename", sa.String(255), nullable=False),
+        sa.Column("size_bytes", sa.Integer(), nullable=False),
+        sa.Column("sha256", sa.String(64), nullable=False),
+        sa.Column("storage_path", sa.String(512), nullable=False),
+        sa.Column("status", sa.String(16), nullable=False, server_default="DRAFT"),
+        sa.Column("release_notes", sa.Text(), nullable=True),
+        sa.Column("created_by", sa.Integer(), sa.ForeignKey("admin_users.id"), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("published_at", sa.DateTime(timezone=True), nullable=True),
+        sa.UniqueConstraint("version", "platform", "architecture", name="uq_agent_release_version"),
+    )
+    op.create_index("ix_agent_releases_version", "agent_releases", ["version"])
+    op.create_index("ix_agent_releases_sha256", "agent_releases", ["sha256"])
+    op.create_index("ix_agent_releases_status", "agent_releases", ["status"])
+
+    op.create_table(
+        "agent_enrollments",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("enrollment_uuid", sa.String(36), nullable=False),
+        sa.Column("tenant_id", sa.Integer(), sa.ForeignKey("tenants.id"), nullable=False),
+        sa.Column("display_name", sa.String(160), nullable=False),
+        sa.Column("expected_hostname", sa.String(255), nullable=True),
+        sa.Column("release_id", sa.Integer(), sa.ForeignKey("agent_releases.id"), nullable=False),
+        sa.Column("status", sa.String(16), nullable=False, server_default="PENDING"),
+        sa.Column("created_by", sa.Integer(), sa.ForeignKey("admin_users.id"), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("download_token_hash", sa.String(64), nullable=True),
+        sa.Column("download_token_expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("download_max_uses", sa.Integer(), nullable=False, server_default="1"),
+        sa.Column("download_uses", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("downloaded_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("enrollment_token_hash", sa.String(64), nullable=True),
+        sa.Column("enrollment_token_expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("enrollment_used_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("machine_fingerprint_seen", sa.String(128), nullable=True),
+        sa.Column("hostname_seen", sa.String(255), nullable=True),
+        sa.Column("hostname_mismatch", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column("agent_id", sa.Integer(), sa.ForeignKey("agents.id"), nullable=True),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("enrollment_uuid", name="uq_agent_enrollment_uuid"),
+    )
+    op.create_index("ix_agent_enrollments_uuid", "agent_enrollments", ["enrollment_uuid"])
+    op.create_index("ix_agent_enrollments_tenant", "agent_enrollments", ["tenant_id"])
+    op.create_index("ix_agent_enrollments_release", "agent_enrollments", ["release_id"])
+    op.create_index("ix_agent_enrollments_status", "agent_enrollments", ["status"])
+    op.create_index("ix_agent_enrollments_agent", "agent_enrollments", ["agent_id"])
+
+
+def downgrade():
+    op.drop_index("ix_agent_enrollments_agent", table_name="agent_enrollments")
+    op.drop_index("ix_agent_enrollments_status", table_name="agent_enrollments")
+    op.drop_index("ix_agent_enrollments_release", table_name="agent_enrollments")
+    op.drop_index("ix_agent_enrollments_tenant", table_name="agent_enrollments")
+    op.drop_index("ix_agent_enrollments_uuid", table_name="agent_enrollments")
+    op.drop_table("agent_enrollments")
+    op.drop_index("ix_agent_releases_status", table_name="agent_releases")
+    op.drop_index("ix_agent_releases_sha256", table_name="agent_releases")
+    op.drop_index("ix_agent_releases_version", table_name="agent_releases")
+    op.drop_table("agent_releases")