fix: agent acknowledgment recursion and subsystem UI improvements

- Fix recursive call in reportLogWithAck that caused infinite loop
- Add machine binding and security API endpoints
- Enhance AgentScanners component with security status display
- Update scheduler and timeout service reliability
- Remove deprecated install.sh script
- Add subsystem configuration and logging improvements

aggregator-server/internal/api/handlers/setup.go

@@ -387,9 +387,15 @@ func (h *SetupHandler) ConfigureServer(c *gin.Context) {
 	fmt.Println("Updating PostgreSQL password from bootstrap to user-provided password...")
 	bootstrapPassword := "redflag_bootstrap"  // This matches our bootstrap .env
 	if err := updatePostgresPassword(req.DBHost, req.DBPort, req.DBUser, bootstrapPassword, req.DBPassword); err != nil {
-		fmt.Printf("Warning: Failed to update PostgreSQL password: %v\n", err)
-		fmt.Println("Will proceed with configuration anyway...")
+		fmt.Printf("CRITICAL ERROR: Failed to update PostgreSQL password: %v\n", err)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error": "Failed to update database password. Setup cannot continue.",
+			"details": err.Error(),
+			"help": "Ensure PostgreSQL is accessible and the bootstrap password is correct. Check Docker logs for details.",
+		})
+		return
 	}
+	fmt.Println("PostgreSQL password successfully updated from bootstrap to user-provided password")
 
 	// Step 2: Generate configuration content for manual update
 	fmt.Println("Generating configuration content for manual .env file update...")
@@ -414,6 +420,11 @@ func (h *SetupHandler) ConfigureServer(c *gin.Context) {
 
 // GenerateSigningKeys generates Ed25519 keypair for agent update signing
 func (h *SetupHandler) GenerateSigningKeys(c *gin.Context) {
+	// Prevent caching of generated keys (security critical)
+	c.Header("Cache-Control", "no-store, no-cache, must-revalidate, private")
+	c.Header("Pragma", "no-cache")
+	c.Header("Expires", "0")
+
 	// Generate Ed25519 keypair
 	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
 	if err != nil {
@@ -428,6 +439,9 @@ func (h *SetupHandler) GenerateSigningKeys(c *gin.Context) {
 	// Generate fingerprint (first 16 chars)
 	fingerprint := publicKeyHex[:16]
 
+	// Log key generation for security audit trail (only fingerprint, not full key)
+	fmt.Printf("Generated new Ed25519 keypair - Fingerprint: %s\n", fingerprint)
+
 	c.JSON(http.StatusOK, gin.H{
 		"public_key":  publicKeyHex,
 		"private_key": privateKeyHex,