Make rollback, first upgrades and pin changes work as tested on Windows

Found in an end-to-end test on a Windows 11 VM against a self-signed server.

- Rollback: a 1.20 agent re-enrolls within a second of an un-enroll, so an
  older agent pushed afterwards arrived on an enrolled PC and was refused.
  Revoke now takes {"blockreenroll": true, "reason": ...}; a blocked PC is
  never issued a credential and keeps working on the shared key until
  POST .../assets/<assetid>/allow-reenroll. The Enrollment page offers the
  block when un-enrolling and shows blocked PCs with an allow button.
- First upgrade of old agents: agents before 1.20 check the server
  certificate when downloading the upgrade, so a store wave failed on PCs that
  do not trust a self-signed server while the Migration tab said ready. A
  failed download now marks the PC blocked with "server certificate not
  trusted by this PC". New Install-ShopDBServerCertificate.ps1 (GE-Enforce,
  SYSTEM) adds a non-CA server certificate to the trusted roots after checking
  its thumbprint; the server certificate page offers a .cer download and the
  SHA-1 thumbprint.
- The generated installer writes ServerPins (with an optional next pin for a
  planned rotation), can leave the shared key out so the PC waits for
  approval, never touches an existing credential, and skips the trusted-root
  import for a CA certificate.
- The agent re-reads server pins about every 60 seconds and recycles pooled
  connections within 2 minutes, so a pin change needs no restart.
- An alert can only be acknowledged by a PC it targets.
- A wave no longer counts a PC as failed after a later wave upgraded it.
- The scripts report a pin mismatch only when the pin really is missing, and
  otherwise log the real error.
- Runbook: trust step before the first wave, rollback order, pin re-read,
  verifying the pin against the live URL; agent contract updated.

plugins/endpoints/models/credential.py

@@ -4,7 +4,10 @@
                  One row per asset. Holds only the sha256 of the secret the
                  agent was issued, plus a short display prefix. Revoking sets
                  revokedat; re-issuing after a revoke UPDATES the same row, so
-                 an asset never carries two credentials.
+                 an asset never carries two credentials. reenrollblocked keeps
+                 a revoked PC from enrolling again (rolling it back to an agent
+                 that only knows the shared key, or a compromised PC) until an
+                 admin allows it.
 
   EndpointEnrollRequest
                  One row per (hostname, serial number) that asked to enroll. The
@@ -49,6 +52,9 @@ class EndpointCredential(db.Model):
     lastusedat = db.Column(db.DateTime, nullable=True)
     revokedat = db.Column(db.DateTime, nullable=True)
     revokedby = db.Column(db.String(64), nullable=True)
+    reenrollblocked = db.Column(db.Boolean, nullable=False, default=False,
+                                server_default=db.false())
+    reenrollblockedreason = db.Column(db.String(64), nullable=True)
 
     @property
     def isactive(self):
@@ -64,6 +70,8 @@ class EndpointCredential(db.Model):
             'lastusedat': _utciso(self.lastusedat),
             'revokedat': _utciso(self.revokedat),
             'revokedby': self.revokedby,
+            'reenrollblocked': bool(self.reenrollblocked),
+            'reenrollblockedreason': self.reenrollblockedreason,
         }
 
     def __repr__(self):