Merge origin/main (West Jeff) into wilm

Bring in the natural-key import fix, Metrics->Monitors rename, PC detail tabbing and panel groups, guest search grants, and the 2026-08-30 security fixes. Reconcile endpoint packaging/installer, migrations, contract version, and tests; keep the delivery uninstaller and 6-step installer alongside main's permission-based RBAC and pin-drift protection.

plugins/endpoints/api/siteagent.py

@@ -31,7 +31,8 @@ import zipfile
 
 from flask import request, current_app, send_file
 
-from shopdb.api import success_response, error_response, ErrorCodes, require_role
+from shopdb.api import (success_response, error_response, ErrorCodes,
+                        require_permission)
 
 from .routes import endpoints_bp
 
@@ -166,16 +167,16 @@ FILES
 USAGE
   1. Copy this whole folder to the target endpoint.
   2. Right-click install.ps1 and Run with PowerShell as administrator. It
-     writes the server URL and collector key to HKLM\\SOFTWARE\\GE\\ShopDB,
-     copies the agent into Program Files, and starts the service. It also
-     registers the tray to autostart for every user at logon and adds a
-     "ShopDB Agent" Start Menu shortcut for manual relaunch.
+           writes the server URL and collector key to HKLM\\SOFTWARE\\GE\\ShopDB,
+           copies the agent into Program Files, and starts the service. It also
+           registers the tray to autostart for every user at logon and adds a
+           "ShopDB Agent" Start Menu shortcut for manual relaunch.
 
-UNINSTALL
-  Run uninstall-shopdbagent.ps1 from an elevated PowerShell to fully remove the
-  agent, tray autostart, Start Menu shortcut, and credentials.
+     UNINSTALL
+       Run uninstall-shopdbagent.ps1 from an elevated PowerShell to fully remove the
+       agent, tray autostart, Start Menu shortcut, and credentials.
 
-SECURITY
+     SECURITY
   install.ps1 carries a live collector key in its default -CollectorKey value.
   Treat this package as a secret. The key is not recoverable from the ShopDB
   server after it was generated; regenerate the key in the UI to revoke it.
@@ -456,14 +457,14 @@ def _siteagent_status_payload():
 
 
 @endpoints_bp.route('/siteagent', methods=['GET'])
-@require_role('admin')
+@require_permission('endpoints.agentpackage')
 def get_siteagent():
     """Report whether the site agent build has a prebuilt binary staged."""
     return success_response(_siteagent_status_payload())
 
 
 @endpoints_bp.route('/siteagent/package', methods=['POST'])
-@require_role('admin')
+@require_permission('endpoints.agentpackage')
 def package_siteagent():
     """Bundle the site agent as a downloadable ZIP.