feat(server): v2 secure-session-core Task 2 - auth rebuild

SPEC-002 Phase 1 Task 2 (specs/v2-secure-session-core), code-reviewed APPROVED.

- DELETE the JWT-as-agent-key branch in relay validate_agent_api_key (audit
  CRITICAL): agent auth now = per-agent cak_ key (SHA-256 -> connect_agent_keys,
  revoked filtered) OR support code OR deprecated shared AGENT_API_KEY (warned).
  A user JWT can no longer authenticate an agent.
- auth/agent_keys.rs: cak_ gen (OsRng 256-bit) + SHA-256 hash + verify.
- auth/jwt.rs: ViewerClaims + create/validate_viewer_token (5-min TTL,
  purpose=viewer, session_id+tenant_id claims; non-interchangeable with login).
- Admin key issuance: POST/GET/DELETE /api/machines/:agent_id/keys.
- POST /api/sessions/:id/viewer-token mints a session-bound short-lived token.
- Migration 005: organization/site/tags on connect_machines (fixes the silent
  update_machine_metadata write, coord todo faf39fe0).

NOTE: viewer-token minting is gated by AuthenticatedUser only; the AUTHORIZATION
check (admin/permission gate) that closes audit CRITICAL #1 lands in Task 3 (the
viewer WS verification). The viewer WS path (relay/mod.rs:285) is untouched here.
Not cargo-check-verified (no toolchain on the authoring host) - self-reviewed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/db/machines.rs

@@ -22,6 +22,18 @@ pub struct Machine {
     pub updated_at: DateTime<Utc>,
     /// Tenancy-ready (Phase 4). Backfilled to the default tenant by migration 004.
     pub tenant_id: Option<Uuid>,
+    /// Company/organization name reported by the agent (`AgentStatus.organization`).
+    /// Column added in migration 005; previously written by `update_machine_metadata`
+    /// against a non-existent column (the write silently failed). Now mapped here so
+    /// `SELECT *` returns it.
+    pub organization: Option<String>,
+    /// Site/location name reported by the agent (`AgentStatus.site`). Migration 005.
+    pub site: Option<String>,
+    /// Free-form tags reported by the agent (`AgentStatus.tags`). Stored as a
+    /// Postgres `TEXT[]`; matches the `&[String]` bound by `update_machine_metadata`.
+    /// Migration 005. `NULL`/absent column reads back as an empty vec via the default.
+    #[serde(default)]
+    pub tags: Vec<String>,
 }
 
 /// Get or create a machine by agent_id (upsert)