Add agent fingerprinting, client certificate auth, and security audit documentation

This commit adds:
- Database migrations for app_delta fingerprints and client certificates
- Scripts for certificate generation and fingerprint backfilling
- Comprehensive security audit reports and findings tracking
- Implementation documentation for certificate authentication
- Test utilities for certificate renewal and fingerprinting
- GE-ENFORCE collector fix documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

plugins/endpoints/migrations/versions/0021_client_certificates.py

@@ -0,0 +1,42 @@
+"""Add client certificate authentication columns
+
+Revision ID: endpoints0021clientcerts
+Revises: endpoints0020appfingerprints
+Create Date: 2026-09-14
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'endpoints0021clientcerts'
+down_revision = 'endpoints0020appfingerprints'  # Will resolve to actual revision ID
+branch_labels = None
+depends_on = None
+plugin_name = 'endpoints'
+
+
+def upgrade():
+    # Add client cert columns to assets table
+    op.add_column('assets',
+        sa.Column('client_cert_fingerprint', sa.String(64), nullable=True))
+
+    op.add_column('assets',
+        sa.Column('cert_issued_at', sa.DateTime, nullable=True))
+
+    op.add_column('assets',
+        sa.Column('cert_expires_at', sa.DateTime, nullable=True))
+
+    # Add index for fast fingerprint lookup during authentication
+    op.create_index(
+        'idx_assets_cert_fingerprint',
+        'assets',
+        ['client_cert_fingerprint'],
+        unique=False
+    )
+
+
+def downgrade():
+    op.drop_index('idx_assets_cert_fingerprint', 'assets')
+    op.drop_column('assets', 'cert_expires_at')
+    op.drop_column('assets', 'cert_issued_at')
+    op.drop_column('assets', 'client_cert_fingerprint')