feat(agent): v0.3.5 Windows inbound forwarding, UI actions, lifecycle

- Configure tailscale serve automatically for each instance on Windows userspace networking.
- Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes).
- Clean shutdown: stop tailscaled and instances, notify server with instance_stopped.
- Restart tailscaled on agent boot using persisted state when pre-auth key is absent.
- Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts).
- Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key.
- Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md.
- Bump agent version to 0.3.5.

server/app/api/templates/route.ts

@@ -1,25 +1,57 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
+import { requireAuth, requireRole, forbidden } from "@/lib/api-auth";
+
+function templateAccessWhere(user: { role: string; establishmentId?: string }, establishmentId?: string | null) {
+  if (user.role === "superadmin" && establishmentId) {
+    return { OR: [{ isPublic: true }, { establishmentId }] };
+  }
+  if (user.establishmentId) {
+    return { OR: [{ isPublic: true }, { establishmentId: user.establishmentId }] };
+  }
+  return { isPublic: true };
+}
+
+async function canManageTemplate(user: { role: string; establishmentId?: string }, id: string) {
+  if (user.role === "superadmin") return true;
+  const template = await prisma.template.findUnique({ where: { id } });
+  if (!template) return false;
+  return template.establishmentId === user.establishmentId;
+}
 
 export async function GET(req: NextRequest) {
+  const user = await requireAuth();
+  if (user instanceof NextResponse) return user;
+
   const { searchParams } = new URL(req.url);
-  const establishmentId = searchParams.get("establishmentId");
+  const requestedEst = searchParams.get("establishmentId");
+
+  const where = user.role === "superadmin" && !requestedEst ? {} : templateAccessWhere(user, requestedEst);
 
   const templates = await prisma.template.findMany({
-    where: {
-      OR: [
-        { isPublic: true },
-        ...(establishmentId ? [{ establishmentId }] : []),
-      ],
-    },
+    where,
     orderBy: { createdAt: "desc" },
   });
   return NextResponse.json(templates);
 }
 
 export async function POST(req: NextRequest) {
+  const user = await requireAuth();
+  if (user instanceof NextResponse) return user;
+
+  const denied = requireRole(user, "superadmin", "admin");
+  if (denied) return denied;
+
   const body = await req.json();
-  const { name, type, dockerImage, composeConfig, isPublic, establishmentId, createdBy } = body;
+  let { name, type, dockerImage, composeConfig, isPublic, establishmentId, createdBy } = body;
+
+  if (user.role !== "superadmin") {
+    if (establishmentId && establishmentId !== user.establishmentId) {
+      return forbidden();
+    }
+    establishmentId = user.establishmentId;
+  }
+
   const template = await prisma.template.create({
     data: { name, type, dockerImage, composeConfig, isPublic, establishmentId, createdBy },
   });
@@ -27,16 +59,39 @@ export async function POST(req: NextRequest) {
 }
 
 export async function PUT(req: NextRequest) {
+  const user = await requireAuth();
+  if (user instanceof NextResponse) return user;
+
+  const denied = requireRole(user, "superadmin", "admin");
+  if (denied) return denied;
+
   const body = await req.json();
   const { id, ...data } = body;
+  if (!id) return NextResponse.json({ error: "Missing id" }, { status: 400 });
+
+  if (!(await canManageTemplate(user, id))) return forbidden();
+
+  if (user.role !== "superadmin" && data.establishmentId && data.establishmentId !== user.establishmentId) {
+    return forbidden();
+  }
+
   const template = await prisma.template.update({ where: { id }, data });
   return NextResponse.json(template);
 }
 
 export async function DELETE(req: NextRequest) {
+  const user = await requireAuth();
+  if (user instanceof NextResponse) return user;
+
+  const denied = requireRole(user, "superadmin", "admin");
+  if (denied) return denied;
+
   const { searchParams } = new URL(req.url);
   const id = searchParams.get("id");
   if (!id) return NextResponse.json({ error: "Missing id" }, { status: 400 });
+
+  if (!(await canManageTemplate(user, id))) return forbidden();
+
   await prisma.template.delete({ where: { id } });
   return NextResponse.json({ ok: true });
 }