Add agent fingerprinting, client certificate auth, and security audit documentation

This commit adds:
- Database migrations for app_delta fingerprints and client certificates
- Scripts for certificate generation and fingerprint backfilling
- Comprehensive security audit reports and findings tracking
- Implementation documentation for certificate authentication
- Test utilities for certificate renewal and fingerprinting
- GE-ENFORCE collector fix documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

test_renewal_simple.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+echo "=== Certificate Renewal Security Tests ==="
+echo ""
+
+API_KEY="shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43"
+BASE_URL="https://localhost:5001"
+
+echo "Test 1: Hostname Validation - Empty hostname"
+curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
+  -H "X-API-Key: $API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"hostname":""}' \
+  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
+
+echo "Test 2: Hostname Validation - SQL injection attempt"
+curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
+  -H "X-API-Key: $API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"hostname":"test;DROP TABLE"}' \
+  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
+
+echo "Test 3: Hostname Validation - Path traversal"
+curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
+  -H "X-API-Key: $API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"hostname":"../../etc/passwd"}' \
+  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
+
+echo "Test 4: Hostname Validation - Too long (65 chars)"
+curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
+  -H "X-API-Key: $API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"hostname":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}' \
+  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"
+
+echo "Test 5: Valid hostname (should work or rate limit)"
+curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
+  -H "X-API-Key: $API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"hostname":"DESKTOP-HF1K9M4"}' \
+  -s -w "\nStatus: %{http_code}\n" | head -20
+
+echo ""
+echo "=== Check Agent Cert Authentication ==="
+docker-compose logs --tail=500 api 2>&1 | grep "Authenticated asset 2528" | tail -3