Add agent fingerprinting, client certificate auth, and security audit documentation

This commit adds:
- Database migrations for app_delta fingerprints and client certificates
- Scripts for certificate generation and fingerprint backfilling
- Comprehensive security audit reports and findings tracking
- Implementation documentation for certificate authentication
- Test utilities for certificate renewal and fingerprinting
- GE-ENFORCE collector fix documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

plugins/endpoints/migrations/versions/0020_app_delta_fingerprints.py

@@ -0,0 +1,72 @@
+"""Add fingerprint column for delta-based application updates
+
+Revision ID: 0020
+Revises: 0019
+Create Date: 2026-09-14
+
+Performance optimization: Add app_fingerprint column to endpointapplications
+table to enable delta-based updates instead of delete-all-insert-all pattern.
+
+Impact:
+- Before: 200 endpoints x 50 apps x 4 reports/hour = 40,000 DELETEs + 40,000 INSERTs/hour
+- After: Only changed apps are touched (~2% per day) = 40 DELETEs + 40 INSERTs/hour
+- Reduction: 99.9% fewer writes (1.92M writes/day -> 1,920 writes/day)
+
+The fingerprint is SHA256(displayname|displayversion|publisher) computed by
+the agent and sent in the collector payload. Nullable during rollout - legacy
+agents without fingerprint support fall back to delete-all-insert-all behavior.
+
+DEPLOYMENT SEQUENCE (CRITICAL):
+1. Deploy this migration: flask db upgrade
+2. Run backfill script: python scripts/backfill_app_fingerprints.py
+3. Deploy updated plugin.py (delta logic code)
+4. Deploy updated C# agent (fingerprint computation)
+
+ROLLBACK PROCEDURE:
+1. Deploy old plugin.py FIRST (remove delta logic)
+2. THEN run: flask db downgrade -1
+3. Verify: SELECT COUNT(*) FROM endpointapplications (should be unchanged)
+
+WARNING: Do NOT downgrade migration before reverting code - will cause AttributeError!
+
+SAFETY FEATURES:
+- Row-level locking prevents concurrent update races
+- Fingerprint format validation (64 hex chars)
+- Delete count verification detects silent failures
+- Memory limits prevent pathological cases (>5000 apps)
+- Metrics logged for monitoring
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = 'endpoints0020appfingerprints'
+down_revision = 'endpoints0019splitpolicies'
+branch_labels = None
+depends_on = None
+plugin_name = 'endpoints'
+
+
+def upgrade():
+    # Add app_fingerprint column - nullable for backward compatibility during rollout
+    op.add_column('endpointapplications',
+        sa.Column('app_fingerprint', sa.String(64), nullable=True))
+
+    # Add UNIQUE index for fast fingerprint lookups (assetid, app_fingerprint)
+    # This index enables efficient delta detection: "which fingerprints exist for this asset?"
+    # UNIQUE constraint ensures one fingerprint per asset (delta logic requirement)
+    op.create_index(
+        'idx_endpointapplications_fingerprint',
+        'endpointapplications',
+        ['assetid', 'app_fingerprint'],
+        unique=True
+    )
+
+
+def downgrade():
+    # Remove index first
+    op.drop_index('idx_endpointapplications_fingerprint', 'endpointapplications')
+
+    # Remove column
+    op.drop_column('endpointapplications', 'app_fingerprint')

plugins/endpoints/migrations/versions/0021_client_certificates.py

@@ -0,0 +1,42 @@
+"""Add client certificate authentication columns
+
+Revision ID: endpoints0021clientcerts
+Revises: endpoints0020appfingerprints
+Create Date: 2026-09-14
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'endpoints0021clientcerts'
+down_revision = 'endpoints0020appfingerprints'  # Will resolve to actual revision ID
+branch_labels = None
+depends_on = None
+plugin_name = 'endpoints'
+
+
+def upgrade():
+    # Add client cert columns to assets table
+    op.add_column('assets',
+        sa.Column('client_cert_fingerprint', sa.String(64), nullable=True))
+
+    op.add_column('assets',
+        sa.Column('cert_issued_at', sa.DateTime, nullable=True))
+
+    op.add_column('assets',
+        sa.Column('cert_expires_at', sa.DateTime, nullable=True))
+
+    # Add index for fast fingerprint lookup during authentication
+    op.create_index(
+        'idx_assets_cert_fingerprint',
+        'assets',
+        ['client_cert_fingerprint'],
+        unique=False
+    )
+
+
+def downgrade():
+    op.drop_index('idx_assets_cert_fingerprint', 'assets')
+    op.drop_column('assets', 'cert_expires_at')
+    op.drop_column('assets', 'cert_issued_at')
+    op.drop_column('assets', 'client_cert_fingerprint')