feat: Agent distribution with secure enrollment from the control panel

One universal Windows Agent package per version (agent_releases: version/
platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary
lives on a local release-storage volume, never in PostgreSQL). An operator
creates a pending installation (agent_enrollments) from Agents / Servidores
-> + Nova instalação, then either downloads it directly or generates a
one-time HTTPS link (short TTL, single use). Either path streams the
package plus a freshly minted enrollment.json whose token is never written
to storage in plaintext, only its SHA-256 hash. On the client host,
gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non-
HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment
token immediately after, success or failure), writes an ACL-restricted
.env with the newly issued permanent Agent token, and registers the
Windows Service without starting it (Firebird stays unconfigured on
purpose). Idempotent, replay-proof, rate-limited per IP, fully audited,
never logs a secret.

Migration 0022_agent_releases_enrollment (verified fresh-DB ==
upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION
bumped to 1.1.0 as the single source of truth across code, packages, the
release manifest and every published AgentRelease row.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/app/rate_limit.py

@@ -0,0 +1,36 @@
+"""In-memory per-IP rate limiting for pre-authentication routes.
+
+Same spirit as painel-clientes-web's `app/rate_limit.py`: a single-process
+in-memory counter, fine because the Hub runs as one container behind a
+trusted reverse proxy (FORWARDED_ALLOW_IPS), never multiple replicas behind
+a shared load balancer. A process restart resets the history — accepted,
+same tradeoff as that panel's SESSION_SECRET.
+
+Used for the two public, pre-authentication Agent-distribution routes
+(GET /dl/agent/{token}, POST /v1/agents/enroll): invalid attempts count
+against the caller's IP; a legitimate Agent's own successful traffic never
+gets counted, so it can never push other installations over the limit.
+"""
+import time
+
+MAX_ATTEMPTS = 10
+WINDOW_SECONDS = 5 * 60
+
+_attempts: dict[tuple[str, str], list[float]] = {}
+
+
+def _recent(bucket: str, origin: str, now: float) -> list[float]:
+    cutoff = now - WINDOW_SECONDS
+    return [t for t in _attempts.get((bucket, origin), []) if t > cutoff]
+
+
+def blocked(bucket: str, origin: str, now: float | None = None) -> bool:
+    moment = now if now is not None else time.time()
+    return len(_recent(bucket, origin, moment)) >= MAX_ATTEMPTS
+
+
+def record_attempt(bucket: str, origin: str, now: float | None = None) -> None:
+    moment = now if now is not None else time.time()
+    recent = _recent(bucket, origin, moment)
+    recent.append(moment)
+    _attempts[(bucket, origin)] = recent