feat: machine binding and version enforcement

migration 017 adds machine_id to agents table
middleware validates X-Machine-ID header on authed routes
agent client sends machine ID with requests
MIN_AGENT_VERSION config defaults 0.1.22
version utils added for comparison

blocks config copying attacks via hardware fingerprint
old agents get 426 upgrade required
breaking: <0.1.22 agents rejected

aggregator-agent/internal/service/windows.go

@@ -209,6 +209,13 @@ func (s *redflagService) runAgent() {
 				}
 			}
 
+			// Check if commands response is valid
+			if commands == nil {
+				log.Printf("Check-in successful - no commands received (nil response)")
+				elog.Info(1, "Check-in successful - no commands received (nil response)")
+				continue
+			}
+
 			if len(commands.Commands) == 0 {
 				log.Printf("Check-in successful - no new commands")
 				elog.Info(1, "Check-in successful - no new commands")