docs: add administrator guide, update self-tests to 51 passing, update documentation and release notes for v0.3.5

RELEASE_NOTES.md

@@ -1,5 +1,34 @@
 # LOGAR Release Notes
 
+## [v0.3.5] - 2026-09-30
+
+### 🗄️ Enterprise Multi-Engine Storage Architecture
+- **Dynamic Backend Switching**: LOGAR Server Hub now supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy.
+- **Automated Schema Initialization**: Switching to an external database automatically verifies connectivity, provisions normalized tables (`telemetry_events`, `client_seats`, `license_config`, `admin_users`), creates optimized indices, and runs health verification.
+- **Configuration Persistence**: Persistent backend settings are saved in `server_config.json` under `db_engine` and isolated from temporary test environments.
+
+### ⚡ Ingestion Ring Buffer & High-Throughput Batch Flusher
+- **In-Memory Queue Buffering**: Built-in Python `queue.Queue` ring buffer with background worker thread decoupled from socket I/O.
+- **Burst Protection & Cache Mode**: High-velocity bursts are accepted without blocking mTLS 1.3 socket listeners; configurable batch size (`buffer_batch_size`, default 100) and flush interval (`buffer_flush_interval_sec`, default 2.0s).
+- **Graceful Shutdown**: Unflushed buffer entries are cleanly committed to storage on server shutdown.
+- **Explicit Opt-In Administrative Control**: Ingestion buffering is strictly optional and requires explicit administrative activation (never auto-enabled upon license activation).
+
+### 🔐 Zero-Knowledge OpenPGP Data Encryption at Rest
+- **Public-Key Cryptography**: Enterprise SQL payloads (`event_data`) can be encrypted at rest using the server's X.509 RSA-2048 certificate / OpenPGP public key via AES-256-GCM symmetric session keys and RSA-OAEP key encapsulation.
+- **Zero-Knowledge on Database Host**: External database administrators or compromised SQL servers cannot read raw telemetry payloads without the private key located on the LOGAR Server Hub.
+- **Explicit Opt-In Security Model**: Payload encryption is strictly optional and configurable per compliance requirements.
+
+### 📜 Dynamic Licensing Introspection & Clean Dashboard WebUI
+- **Modular Capability Introspection**: PKI X.509 extension OID `1.3.6.1.4.1.58888.1.3` and persistent license records are dynamically parsed to expose active modules (`enterprise_db`, etc.) in a dedicated card on the **📜 Sub-CA & Licensing** tab.
+- **Distraction-Free Tab Navigation**: Cleaned all tab headers to remove redundant item counts and visual badges for a streamlined administrative interface.
+- **Graceful Feature Locking**: Unlicensed enterprise features remain visible but gracefully disabled in the WebUI and rejected by backend API validation.
+
+### 📖 Comprehensive Administrator Guide & Expanded Test Suite
+- **Administrator & Operations Guide**: Published comprehensive 11-chapter guide in [`docs/ADMIN_GUIDE.md`](docs/ADMIN_GUIDE.md) and [`wiki/ADMIN_GUIDE.md`](wiki/ADMIN_GUIDE.md) covering deployment, database switching, queue tuning, zero-knowledge crypto, forwarders, Hermes AI, 2FA, and troubleshooting.
+- **Automated Unit & Integration Tests**: Expanded test suite to **51 automated tests** covering dynamic licensing, WebUI rendering, opt-in isolation, database failovers, and mTLS pipelines.
+
+---
+
 ## [v0.3.4.2] - 2026-09-30
 
 ### 🔒 Exclusive Hardware Host-Binding & Reassignment Controls