Add GuruRMM real-time tunnel architecture and planning

Comprehensive design for transforming agents from 30s heartbeat mode to
persistent tunnel mode, enabling Claude Code to execute commands on remote
machines through secure multiplexed WebSocket channels.

Additions:
- Complete implementation plan with 5-phase roadmap (5-7 weeks to GA)
- Detailed architecture document covering protocol, security, and MCP integration
- Database migration for tech_sessions and tunnel_audit tables

Key architectural decisions:
- Hybrid lifecycle: WebSocket persistent, tunnel is operational state
- Channel multiplexing over single WebSocket (terminal, file ops, etc.)
- Three-layer security: JWT auth, session authorization, command validation
- Custom MCP server for Claude Code integration

Next: Phase 1 implementation (tunnel open/close endpoints, agent mode state machine)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

projects/msp-tools/guru-rmm/server/migrations/006_tunnel_sessions.sql

@@ -0,0 +1,43 @@
+-- GuruRMM Tunnel Sessions Schema
+-- Creates tables for technician SSH tunnel sessions and audit logging
+
+-- Tech Sessions table
+-- Stores active and historical SSH tunnel sessions between technicians and agents
+CREATE TABLE tech_sessions (
+    id SERIAL PRIMARY KEY,
+    session_id VARCHAR(36) UNIQUE NOT NULL,
+    tech_id INTEGER NOT NULL,
+    agent_id UUID NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    opened_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    last_activity TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    closed_at TIMESTAMPTZ,
+    status VARCHAR(20) NOT NULL DEFAULT 'active',
+    CONSTRAINT unique_active_session UNIQUE (tech_id, agent_id, status)
+        WHERE status = 'active'
+);
+
+-- Index for finding sessions by technician
+CREATE INDEX idx_tech_sessions_tech ON tech_sessions(tech_id);
+
+-- Index for finding sessions by agent
+CREATE INDEX idx_tech_sessions_agent ON tech_sessions(agent_id);
+
+-- Index for filtering by session status
+CREATE INDEX idx_tech_sessions_status ON tech_sessions(status);
+
+-- Tunnel Audit table
+-- Detailed audit log for all tunnel operations and channel activity
+CREATE TABLE tunnel_audit (
+    id BIGSERIAL PRIMARY KEY,
+    session_id VARCHAR(36) NOT NULL REFERENCES tech_sessions(session_id) ON DELETE CASCADE,
+    channel_id VARCHAR(36) NOT NULL,
+    operation VARCHAR(50) NOT NULL,
+    details JSONB,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- Index for querying audit logs by session
+CREATE INDEX idx_tunnel_audit_session ON tunnel_audit(session_id);
+
+-- Index for time-based audit queries
+CREATE INDEX idx_tunnel_audit_created ON tunnel_audit(created_at);