feat(agent): v0.3.5 Windows inbound forwarding, UI actions, lifecycle

- Configure tailscale serve automatically for each instance on Windows userspace networking.
- Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes).
- Clean shutdown: stop tailscaled and instances, notify server with instance_stopped.
- Restart tailscaled on agent boot using persisted state when pre-auth key is absent.
- Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts).
- Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key.
- Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md.
- Bump agent version to 0.3.5.

server/app/dashboard/students/[id]/actions.ts

@@ -3,17 +3,9 @@
 import { prisma } from "@/lib/prisma";
 import { getServerSession } from "next-auth/next";
 import { authOptions } from "@/lib/auth-config";
+import { generateUniqueActivationCode } from "@/lib/activation";
 import { redirect } from "next/navigation";
 
-function generateCode(): string {
-  const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-  let code = "";
-  for (let i = 0; i < 6; i++) {
-    code += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return code;
-}
-
 export async function deleteStudent(formData: FormData) {
   const session = await getServerSession(authOptions);
   if (!session?.user) redirect("/login");
@@ -54,9 +46,10 @@ export async function generateActivationCodeAction(formData: FormData) {
 
   if (!student) return;
 
+  const { code, expiresAt } = await generateUniqueActivationCode();
   await prisma.student.update({
     where: { id },
-    data: { activationCode: generateCode() },
+    data: { activationCode: code, activationCodeExpiresAt: expiresAt },
   });
 
   redirect(`/dashboard/students/${id}`);