feat(agent): v0.3.5 Windows inbound forwarding, UI actions, lifecycle

- Configure tailscale serve automatically for each instance on Windows userspace networking.
- Add local UI buttons: start/stop/reset/delete instances (stop/start preserve volumes).
- Clean shutdown: stop tailscaled and instances, notify server with instance_stopped.
- Restart tailscaled on agent boot using persisted state when pre-auth key is absent.
- Sync instance stopped/deleted status to dashboard (server/lib/websocket.ts).
- Security: include prior authz/scoping changes across API routes, ephemeral pre-auth keys, ACL policy, internal API key.
- Update SUIVI_VPN_ONDEMAND.md and docs/ONBOARDING_CLIENT.md.
- Bump agent version to 0.3.5.

server/prisma/schema.prisma

@@ -50,21 +50,23 @@ model Class {
 }
 
 model Student {
-  id             String     @id @default(cuid())
-  classId        String
-  class          Class      @relation(fields: [classId], references: [id], onDelete: Cascade)
-  firstName      String
-  lastName       String
-  email          String
-  activationCode String?    @unique
-  createdAt      DateTime   @default(now())
-  nodes          Node[]
+  id                      String     @id @default(cuid())
+  classId                 String
+  class                   Class      @relation(fields: [classId], references: [id], onDelete: Cascade)
+  firstName               String
+  lastName                String
+  email                   String
+  activationCode          String?    @unique
+  activationCodeExpiresAt DateTime?
+  createdAt               DateTime   @default(now())
+  nodes                   Node[]
 }
 
 model Node {
   id          String     @id
   studentId   String?
   student     Student?   @relation(fields: [studentId], references: [id], onDelete: Cascade)
+  token       String?    @unique
   tailscaleIp String?
   status      String     @default("offline")
   lastSeen    DateTime?