Add agent fingerprinting, client certificate auth, and security audit documentation

This commit adds:
- Database migrations for app_delta fingerprints and client certificates
- Scripts for certificate generation and fingerprint backfilling
- Comprehensive security audit reports and findings tracking
- Implementation documentation for certificate authentication
- Test utilities for certificate renewal and fingerprinting
- GE-ENFORCE collector fix documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

agent/test-fingerprint.ps1

@@ -0,0 +1,76 @@
+# Test fingerprint computation matches Python backend
+# Expected: SHA256("Google Chrome|117.0.5938.132|Google LLC")
+
+$code = @"
+using System;
+using System.Security.Cryptography;
+using System.Text;
+
+public class FingerprintTester
+{
+    public static string ComputeFingerprint(string displayName, string displayVersion, string publisher)
+    {
+        var normalized = $"{displayName}|{displayVersion}|{publisher}";
+        var bytes = Encoding.UTF8.GetBytes(normalized);
+        var hash = SHA256.HashData(bytes);
+        return Convert.ToHexString(hash).ToLowerInvariant();
+    }
+}
+"@
+
+Add-Type -TypeDefinition $code
+
+# Test vectors from backend
+$tests = @(
+    @{
+        Name = "Google Chrome"
+        Version = "117.0.5938.132"
+        Publisher = "Google LLC"
+        Description = "Standard application"
+    },
+    @{
+        Name = "Microsoft Office"
+        Version = "16.0.16827.20166"
+        Publisher = "Microsoft Corporation"
+        Description = "Office suite"
+    },
+    @{
+        Name = "Test App No Version"
+        Version = ""
+        Publisher = "Test Publisher"
+        Description = "Empty version string"
+    },
+    @{
+        Name = "Test App Empty"
+        Version = ""
+        Publisher = ""
+        Description = "Empty strings"
+    }
+)
+
+Write-Host "C# Fingerprint Algorithm Test" -ForegroundColor Cyan
+Write-Host "==============================" -ForegroundColor Cyan
+Write-Host ""
+
+foreach ($test in $tests) {
+    $fp = [FingerprintTester]::ComputeFingerprint($test.Name, $test.Version, $test.Publisher)
+    Write-Host "Test: $($test.Description)" -ForegroundColor Yellow
+    Write-Host "  Input: '$($test.Name)|$($test.Version)|$($test.Publisher)'"
+    Write-Host "  Fingerprint: $fp" -ForegroundColor Green
+    Write-Host "  Length: $($fp.Length) chars" -ForegroundColor Gray
+    Write-Host ""
+}
+
+# Verify format
+$testFp = [FingerprintTester]::ComputeFingerprint("Test", "1.0", "Publisher")
+if ($testFp.Length -eq 64) {
+    Write-Host "Format check: PASS (64 characters)" -ForegroundColor Green
+} else {
+    Write-Host "Format check: FAIL (expected 64, got $($testFp.Length))" -ForegroundColor Red
+}
+
+if ($testFp -match '^[0-9a-f]{64}$') {
+    Write-Host "Hex check: PASS (lowercase hexadecimal)" -ForegroundColor Green
+} else {
+    Write-Host "Hex check: FAIL (invalid characters)" -ForegroundColor Red
+}