Finish secure agent connection (cert pinning discoverability + vendored sync + MSI source)

[Mischa323]

Completes the secure-connection work that was started but never landed. The core
logic shipped earlier — agent cert pinning + per-device-secret client
(leuffen-rmm-agent) and server-side device-secret issue/validate (PR #35) — but
several loose ends meant it wasn't actually usable or consistent end to end. This
ties them off.

Pairs with leuffen-rmm-agent#4 (canonical agent gains config-file fingerprint);
merge that first so the vendored copy here stays in step.

What was unfinished

1. Cert pinning was undiscoverable. The agent could pin RMM_SERVER_FINGERPRINT
   but the server never exposed its own fingerprint, so an admin had no way to know
   what to pin.
2. Vendored agent was stale. The server image bundles agent/ (COPY agent /agent) and serves it via agent.zip, but that copy lacked cert pinning, the
   device-secret client, and the login/lock-screen capture — so zip-installed
   agents differed from MSI ones. (The old claude/sync-vendored-agent branch only
   half-synced it and was never merged — this supersedes it.)
3. MSI download pointed at the wrong repo. RMM_MSI_URL/RMM_GH_REPO still
   defaulted to this repo (stale v1.1.x agent) after the build moved to
   leuffen-rmm-agent (v2.x with the secure code).
4. Undocumented. None of SESSION_SECRET / RMM_SERVER_FINGERPRINT /
   RMM_REQUIRE_DEVICE_SECRET were in the docs.

Changes

• tls.cert_fingerprint() — SHA-256 of the leaf cert DER (PEM→DER via base64,
  no new deps); matches what the agent hashes from getpeercert(binary_form=True).
  Verified equal to cryptography's fingerprint(SHA256) and to openssl.
• GET /api/server-fingerprint (global admin) → {fingerprint, tls_mode};
  null in proxy mode.
• Startup log prints the fingerprint (non-proxy modes).
• Settings → Security shows a read-only fingerprint card with copy button +
  pinning instructions (lazy-loaded like the logs tab).
• Vendored agent synced verbatim to canonical v2.2.10 (agent.py, handlers.py,
  inventory.py, screen.py, updater.py).
• MSI defaults repointed to Mischa323/leuffen-rmm-agent (asset
  leuffen-rmm-agent.msi, confirmed on v2.2.10).
• Docs — README "Secure connection" section (env-var table + safe rollout
  order) and CHANGELOG.

Verification

• py_compile on all server + vendored-agent modules; node --check on
  settings.js.
• Fingerprint helper validated against cryptography and openssl (exact match;
  agent-side colon/upper normalisation round-trips).

Operational follow-ups (not code)

• Release leuffen-rmm-agent so the MSI carries agent#4.
• After the fleet is on the new agent and each has reconnected once, set
  RMM_REQUIRE_DEVICE_SECRET=1 to enforce the device secret.
• The stale claude/sync-vendored-agent branch can be deleted (superseded here).

🤖 Generated with Claude Code