feat: Agent distribution with secure enrollment from the control panel

One universal Windows Agent package per version (agent_releases: version/
platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary
lives on a local release-storage volume, never in PostgreSQL). An operator
creates a pending installation (agent_enrollments) from Agents / Servidores
-> + Nova instalação, then either downloads it directly or generates a
one-time HTTPS link (short TTL, single use). Either path streams the
package plus a freshly minted enrollment.json whose token is never written
to storage in plaintext, only its SHA-256 hash. On the client host,
gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non-
HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment
token immediately after, success or failure), writes an ACL-restricted
.env with the newly issued permanent Agent token, and registers the
Windows Service without starting it (Firebird stays unconfigured on
purpose). Idempotent, replay-proof, rate-limited per IP, fully audited,
never logs a secret.

Migration 0022_agent_releases_enrollment (verified fresh-DB ==
upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION
bumped to 1.1.0 as the single source of truth across code, packages, the
release manifest and every published AgentRelease row.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/hub/.env.example

@@ -1,5 +1,5 @@
 # GTI Fiscal Hub — production environment (copy to .env, never commit .env)
-GTI_FISCAL_VERSION=1.0.0-rc1
+GTI_FISCAL_VERSION=1.1.0
 
 # REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
 POSTGRES_PASSWORD=
@@ -27,5 +27,11 @@ FEDERATED_SESSION_SECONDS=3600
 LOG_LEVEL=INFO
 AGENT_ONLINE_THRESHOLD_SECONDS=120
 
+# Agent distribution (docs/PILOT_DEPLOYMENT.md, "Agent distribution"). Defaults
+# are safe; override only if the pilot needs a longer/shorter window.
+# AGENT_DOWNLOAD_LINK_TTL_SECONDS=1800
+# AGENT_DOWNLOAD_MAX_USES_DEFAULT=1
+# AGENT_ENROLLMENT_TTL_SECONDS=86400
+
 # Directory (host) where pg_dump backups are written by backup.sh
 BACKUP_DIR=./backups

deploy/hub/docker-compose.prod.yml

@@ -36,7 +36,7 @@ services:
     build:
       context: ../..
       dockerfile: central/Dockerfile
-    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.0.0-rc1}
+    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.1.0}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -57,7 +57,16 @@ services:
       SSO_GERENCIADOR_CHAVE_PUBLICA: ${SSO_GERENCIADOR_CHAVE_PUBLICA:-}
       SSO_START_URL: ${SSO_START_URL:-}
       FEDERATED_SESSION_SECONDS: ${FEDERATED_SESSION_SECONDS:-3600}
-      # AGENT_DEV_TOKEN is intentionally NOT set: real Agents are registered with central/scripts/register_agent.py.
+      # AGENT_DEV_TOKEN is intentionally NOT set: real Agents are registered with central/scripts/register_agent.py
+      # (manually) or auto-provisioned via a successful POST /v1/agents/enroll (secure enrollment).
+      # Agent distribution (central/app/agent_distribution.py): the universal package zip lives on the
+      # agent_releases volume below, never in PostgreSQL. TTLs have safe defaults; override only if needed.
+      AGENT_RELEASE_STORAGE_PATH: /app/data/releases
+      AGENT_DOWNLOAD_LINK_TTL_SECONDS: ${AGENT_DOWNLOAD_LINK_TTL_SECONDS:-1800}
+      AGENT_DOWNLOAD_MAX_USES_DEFAULT: ${AGENT_DOWNLOAD_MAX_USES_DEFAULT:-1}
+      AGENT_ENROLLMENT_TTL_SECONDS: ${AGENT_ENROLLMENT_TTL_SECONDS:-86400}
+    volumes:
+      - agent_releases:/app/data/releases
     ports:
       - "${HUB_BIND:-127.0.0.1}:${HUB_PORT:-8000}:8000"
     networks: [internal, edge]
@@ -76,3 +85,4 @@ networks:
 
 volumes:
   postgres_data:
+  agent_releases: