feat: machine binding and version enforcement

migration 017 adds machine_id to agents table
middleware validates X-Machine-ID header on authed routes
agent client sends machine ID with requests
MIN_AGENT_VERSION config defaults 0.1.22
version utils added for comparison

blocks config copying attacks via hardware fingerprint
old agents get 426 upgrade required
breaking: <0.1.22 agents rejected

scripts/build-secure-agent.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# RedFlag Agent Build Script
+# Builds agent binary (public key fetched from server at runtime)
+
+set -e
+
+echo "🔨 RedFlag Agent Build"
+echo "====================="
+
+# Build agent
+echo "Building agent..."
+cd aggregator-agent
+
+go build \
+    -o redflag-agent \
+    ./cmd/agent
+
+cd ..
+
+echo "✅ Agent build complete!"
+echo "   Binary: aggregator-agent/redflag-agent"
+echo ""
+echo "ℹ️  Note: Agent will fetch the server's public key automatically at startup"