feat(cluster): Fix "joining" status + cross-node auth federation

1. preRegisterJoiner now runs SYNCHRONOUSLY before IssueCert responds,
   so nftables @peer_ipv4 is updated before the joiner calls autoRegister.
   Previously it was a goroutine → race → autoRegister failed → "joining"
   forever.

2. Stable node ID for pre-registered placeholder (prenode-{fqdn}) instead
   of time-based ID — re-joins are now idempotent.

3. AgentRegisterPeer sets status="online" immediately (peer proved it is
   online by connecting via mTLS) and deletes the prenode-{fqdn} placeholder.

4. autoRegister retries 3× with 2s delay in case of transient nftables lag.

5. Auth federation: cluster nodes forward failed logins to the primary via
   mTLS /agent/auth/check so users can log in on any node with primary
   credentials (no PG replication needed).
   - SystemHandler.AgentAuthCheck: new endpoint on :8443
   - AuthHandler.checkWithPrimary: mTLS call to primary when local auth fails
   - AuthHandler.WithClusterTLS: inject cluster TLS store
   - startAgentListener now uses the wired systemHdl with Users repo

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/edgeguard-api/main.go

@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.157"
+var version = "1.1.158"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
@@ -283,7 +283,8 @@ func main() {
 		// nftables @peer_ipv4 korrekt ist — auch ohne erneuten Join.
 		go setupHdl.StartupPeerSync()
 		usersRepo := usersvc.New(pool)
-		authHdl.WithAudit(auditRepo, nodeID).WithUsers(usersRepo)
+		authHdl.WithAudit(auditRepo, nodeID).WithUsers(usersRepo).WithClusterTLS(clusterTLSStore)
+		systemHdl.WithUsers(usersRepo)
 
 		haproxyReloader := func(ctx context.Context) error {
 			return haproxy.New(pool).Render(ctx)
@@ -454,7 +455,7 @@ func main() {
 	// Listener wird nur gestartet wenn Cert-Material vorhanden ist;
 	// auf einer frisch installierten Box hat die Init-Phase oben das
 	// schon erledigt.
-	startAgentListener(version, agentHdl)
+	startAgentListener(version, agentHdl, systemHdl)
 
 	log.Printf("edgeguard-api %s listening on %s", version, addr)
 	srv := &http.Server{Addr: addr, Handler: r}
@@ -468,7 +469,7 @@ func main() {
 // RegisterAgent — health + resources). Fehler im Cert-Load = no-op
 // + log; Fehler beim Listen.Serve loggen wir aber lassen die API
 // weiterlaufen.
-func startAgentListener(version string, clusterHdl *handlers.ClusterHandler) {
+func startAgentListener(version string, clusterHdl *handlers.ClusterHandler, sysHdl *handlers.SystemHandler) {
 	store := clustertls.New("")
 	serverTLS, err := store.ServerTLSConfig()
 	if err != nil {
@@ -488,7 +489,13 @@ func startAgentListener(version string, clusterHdl *handlers.ClusterHandler) {
 	// hier implizit aus dem Binary (Peer-Roundtrip ist immer same-major).
 	// Aggregator-Aufrufer sehen /agent/... direkt.
 	root := r.Group("")
-	handlers.NewSystemHandler(version).RegisterAgent(root)
+	// Nutze den gewiredeten systemHdl (mit Users + Setup) damit
+	// AgentAuthCheck Credentials gegen die echte DB prüfen kann.
+	if sysHdl != nil {
+		sysHdl.RegisterAgent(root)
+	} else {
+		handlers.NewSystemHandler(version).RegisterAgent(root)
+	}
 	if clusterHdl != nil {
 		// Phase 3.5: /agent/cluster/peers (Auto-Register).
 		clusterHdl.RegisterAgent(root)

cmd/edgeguard-ctl/main.go

@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.157"
+var version = "1.1.158"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 

cmd/edgeguard-scheduler/main.go

@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.157"
+var version = "1.1.158"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.