feat: machine binding and version enforcement

migration 017 adds machine_id to agents table
middleware validates X-Machine-ID header on authed routes
agent client sends machine ID with requests
MIN_AGENT_VERSION config defaults 0.1.22
version utils added for comparison

blocks config copying attacks via hardware fingerprint
old agents get 426 upgrade required
breaking: <0.1.22 agents rejected

Makefile

@@ -26,6 +26,9 @@ build-server: ## Build server binary
 build-agent: ## Build agent binary
 	cd aggregator-agent && go mod tidy && go build -o bin/aggregator-agent cmd/agent/main.go
 
+build-agent-simple: ## Build agent binary with simple script
+	@./scripts/build-secure-agent.sh
+
 clean: ## Clean build artifacts
 	rm -rf aggregator-server/bin aggregator-agent/bin