Session log: multi-user setup, audit + gap fixes, Howard onboarding package

Two session logs:
- session-logs/2026-04-16-session.md: cross-cutting (multi-user, audit, infrastructure)
- guru-rmm session log appended: MSI installer, Len's Auto Brokerage, Uranus, migration drift

Gap fixes: GrepAI initialized + MCP server added, Ollama models pulling,
settings.json created (bypassPermissions), MCP_SERVERS.md written.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

projects/msp-tools/guru-rmm/session-logs/2026-04-16-session.md

@@ -305,3 +305,55 @@ az ad sp credential reset --id 516d0bdc-5416-4d02-8521-b70e2bb26d29
 - **First signed MSI:** 2026-04-16 15:15 UTC (gururmm-agent-0.6.1.msi, 1.16 MB)
 - **Full Microsoft cert chain validates** through signtool from Windows workstation for both .exe and .msi
 - **Billing impact:** Trusted Signing Basic ~$9.99/mo + per-signature fees (fractional cents each). SP creation, cert profile creation, jsign — all free.
+
+---
+
+## Update: afternoon (continued same day)
+
+### MSI Installer — tested + verified
+
+- WiX 5.0.2 installed on Windows workstation via `dotnet tool install --global wix --version 5.0.2`
+- WiX does NOT work on Linux (despite .NET tooling — errors on Directory path validation). Windows-only for MSI builds.
+- WiX 7 was blocked by OSMF EULA requirement — stepped back to v5.
+- Built minimal `installer/gururmm.wxs` (installs exe to Program Files, creates ProgramData dir, Apps & Features entry)
+- Signed MSI via `sign.ps1` — full chain verifies (Arizona Computer Guru LLC)
+- Test install: `msiexec /qn` silent install ✓, signature preserved on installed binary ✓, Apps & Features shows publisher ✓, uninstall clean ✓
+- `installer/build-msi.ps1` wrapper script created (downloads signed agent, builds MSI, signs MSI, emits sha256)
+- Decision: Jupiter Windows VM (Server 2022) planned for production MSI builds; WiX on user's workstation for now
+
+### Len's Auto Brokerage — test client onboarded
+
+- **Client:** Len's Auto Brokerage (code: LAB)
+- **Client ID:** bc76984f-8dc9-42e7-b978-c8def1143144
+- **Site:** Main
+- **Site ID:** d8f69cd8-5c42-43bc-ae45-9cc6078d37fb
+- **Site code:** UPPER-STAR-2820
+- **API key:** grmm_mnR0gxGRxZ9wMqyn9Q4QxCrn6jbsJkZW (shown once, saved to vault)
+- ~10 Windows endpoints planned
+- Vault entry: `clients/lens-auto-brokerage.sops.yaml`
+
+### Server migration issue discovered
+
+- Attempted to rebuild gururmm-server to get `/install/:site_code` routes (exist in source but not in running binary)
+- New build fails: `migration 5 was previously applied but has been modified` — sqlx checksum drift
+- Migration 5 (005_temperature_metrics.sql) file content unchanged per git but sha384 doesn't match DB's recorded hash
+- Likely cause: sqlx crate version upgrade changed hash algorithm, or file bytes changed via line-ending normalization
+- Rolled back to stable binary (production restored, /health OK)
+- **Open item:** fix migration checksum drift to deploy server with install landing page routes
+
+### Smart App Control docs
+
+- Documented how to check/disable SAC on Windows 11 (for agent install at client sites)
+- SAC is separate from SmartScreen — our Public Trust signing helps SmartScreen but SAC is stricter
+- Main path: check state via `Get-MpComputerStatus`, disable via Settings if blocking, add Defender exclusions
+
+### Uranus server (ex-Pavon) — documented
+
+- Pavon server renamed to Uranus, re-IP'd from 172.16.1.33 → 172.16.3.21
+- OwnCloud external storage mount (ID 6, SMB share `Storage`) updated from old IP to new via `occ files_external:config 6 host 172.16.3.21`
+- Verified: `files_external:verify 6` → status ok
+- Swept all infrastructure (vault, CF DNS, NPM, pfSense) — no other references to old IP
+- Dell PowerEdge R730xd, 32 threads (Xeon E5-2630 v3), only 7.7 GiB RAM (2× 4GB RDIMM in 24 slots)
+- RAM upgrade needed before Windows build VM — recommended 8× 8GB DDR4 RDIMM (~$50 eBay)
+- Jupiter VM for build in the meantime (125 GiB RAM, ~60 GiB free)
+- Vault entry: `infrastructure/uranus-unraid.sops.yaml`, credentials.md updated