fix(security): Implement Phase 1 critical security fixes

CORS:
- Restrict CORS to DASHBOARD_URL environment variable
- Default to production dashboard domain

Authentication:
- Add AuthUser requirement to all agent management endpoints
- Add AuthUser requirement to all command endpoints
- Add AuthUser requirement to all metrics endpoints
- Add audit logging for command execution (user_id tracked)

Agent Security:
- Replace Unicode characters with ASCII markers [OK]/[ERROR]/[WARNING]
- Add certificate pinning for update downloads (allowlist domains)
- Fix insecure temp file creation (use /var/run/gururmm with 0700 perms)
- Fix rollback script backgrounding (use setsid instead of literal &)

Dashboard Security:
- Move token storage from localStorage to sessionStorage
- Add proper TypeScript types (remove 'any' from error handlers)
- Centralize token management functions

Legacy Agent:
- Add -AllowInsecureTLS parameter (opt-in required)
- Add Windows Event Log audit trail when insecure mode used
- Update documentation with security warnings

Closes: Phase 1 items in issue #1

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

projects/msp-tools/guru-rmm/server/src/main.rs

@@ -24,7 +24,8 @@ use axum::{
 };
 use sqlx::postgres::PgPoolOptions;
 use tokio::sync::RwLock;
-use tower_http::cors::{Any, CorsLayer};
+use http::HeaderValue;
+use tower_http::cors::{AllowOrigin, CorsLayer};
 use tower_http::trace::TraceLayer;
 use tracing::info;
 
@@ -129,11 +130,34 @@ async fn main() -> Result<()> {
 
 /// Build the application router
 fn build_router(state: AppState) -> Router {
-    // CORS configuration (allow dashboard access)
+    // TODO: Add rate limiting for registration endpoints using tower-governor
+    // Currently, registration is protected by AuthUser authentication.
+    // For additional protection against brute-force attacks, consider adding:
+    // - tower-governor crate for per-IP rate limiting on /api/agents/register
+    // - Configurable limits via environment variables
+    // Reference: https://docs.rs/tower-governor/latest/tower_governor/
+
+    // CORS configuration - restrict to specific dashboard origin
+    let dashboard_origin = std::env::var("DASHBOARD_URL")
+        .unwrap_or_else(|_| "https://rmm.azcomputerguru.com".to_string());
+
     let cors = CorsLayer::new()
-        .allow_origin(Any)
-        .allow_methods(Any)
-        .allow_headers(Any);
+        .allow_origin(AllowOrigin::exact(
+            HeaderValue::from_str(&dashboard_origin).expect("Invalid DASHBOARD_URL"),
+        ))
+        .allow_methods([
+            http::Method::GET,
+            http::Method::POST,
+            http::Method::PUT,
+            http::Method::DELETE,
+            http::Method::OPTIONS,
+        ])
+        .allow_headers([
+            http::header::AUTHORIZATION,
+            http::header::CONTENT_TYPE,
+            http::header::ACCEPT,
+        ])
+        .allow_credentials(true);
 
     Router::new()
         // Health check