feat(agent): v0.3.5 Windows inbound forwarding, UI actions, lifecycle

- Configure tailscale serve automatically for each instance on Windows userspace networking.
- Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes).
- Clean shutdown: stop tailscaled and instances, notify server with instance_stopped.
- Restart tailscaled on agent boot using persisted state when pre-auth key is absent.
- Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts).
- Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key.
- Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md.
- Bump agent version to 0.3.5.

server/app/dashboard/students/[id]/actions.ts

@@ -3,17 +3,9 @@
 import { prisma } from "@/lib/prisma";
 import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth-config";
+import { generateUniqueActivationCode } from "@/lib/activation";
 import { redirect } from "next/navigation";
 
-function generateCode(): string {
-  const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-  let code = "";
-  for (let i = 0; i < 6; i++) {
-    code += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return code;
-}
-
 export async function deleteStudent(formData: FormData) {
   const session = await getServerSession(authOptions);
   if (!session?.user) redirect("/login");
@@ -54,9 +46,10 @@ export async function generateActivationCodeAction(formData: FormData) {
 
   if (!student) return;
 
+  const { code, expiresAt } = await generateUniqueActivationCode();
   await prisma.student.update({
     where: { id },
-    data: { activationCode: generateCode() },
+    data: { activationCode: code, activationCodeExpiresAt: expiresAt },
   });
 
   redirect(`/dashboard/students/${id}`);

server/app/dashboard/students/new/page.tsx

@@ -1,6 +1,7 @@
 import { prisma } from "@/lib/prisma";
 import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth-config";
+import { generateUniqueActivationCode } from "@/lib/activation";
 import { redirect } from "next/navigation";
 import { Card, CardHeader, CardTitle, CardContent } from "@/components/ui/card";
 import { Input } from "@/components/ui/input";
@@ -17,15 +18,6 @@ const schema = z.object({
   classId: z.string().min(1),
 });
 
-function generateActivationCode(): string {
-  const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-  let code = "";
-  for (let i = 0; i < 6; i++) {
-    code += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return code;
-}
-
 async function createStudent(formData: FormData) {
   "use server";
   const session = await getServerSession(authOptions);
@@ -35,13 +27,15 @@ async function createStudent(formData: FormData) {
   const parsed = schema.safeParse(Object.fromEntries(formData));
   if (!parsed.success) return;
 
+  const { code, expiresAt } = await generateUniqueActivationCode();
   await prisma.student.create({
     data: {
       firstName: parsed.data.firstName,
       lastName: parsed.data.lastName,
       email: parsed.data.email,
       classId: parsed.data.classId,
-      activationCode: generateActivationCode(),
+      activationCode: code,
+      activationCodeExpiresAt: expiresAt,
     },
   });