feat(ui,docs): add auto_update feature flag integration, UI card, and documentation

README.md

@@ -5,14 +5,14 @@
 # LOGAR: Fleet Log Aggregation & Centralized Provisioning System
 ### *Secure Log Aggregation, PKI Fleet Licensing & Centralized Delivery for Autonomous AI Analysis*
 
-[![Version](https://img.shields.io/badge/version-0.3.5.1-blue.svg)](RELEASE_NOTES.md)
+[![Version](https://img.shields.io/badge/version-0.3.5.2-blue.svg)](RELEASE_NOTES.md)
-[![Tests](https://img.shields.io/badge/tests-51%20passed-success.svg)](tests/)
+[![Tests](https://img.shields.io/badge/tests-94%20passed-success.svg)](tests/)
 [![Security](https://img.shields.io/badge/mTLS-TLS%201.3-green.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing)
 [![Admin Guide](https://img.shields.io/badge/wiki-Admin%20Guide-blueviolet.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)
 
-**LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making.
+**LOGAR** is an enterprise-grade log aggregation, normalization, and centralized provisioning system built for heterogeneous server fleets (Windows & Linux). It pairs ultra-lightweight, zero-state edge forwarders with a secure centralized server hub that enforces mutual TLS 1.3 (**mTLS**) authentication, dynamic PKI fleet licensing with cryptographic seat leasing, fleet auto-update package distribution, 12-hour temporal persistence tracking, and direct anomaly pass-through—delivering clean, structured, verified log telemetry directly to **Hermes AI** for autonomous deep reasoning, contextual root-cause analysis, and operational decision-making.
 
-> 📚 **WebUI Administrator Guide & Technical Wiki**: Complete WebUI console guides, storage switching, ingestion queue tuning, zero-knowledge encryption, and REST API references are available on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and the **[WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)**.
+> 📚 **WebUI Administrator Guide & Technical Wiki**: Complete WebUI console guides, storage switching, ingestion queue tuning, fleet package distribution, zero-knowledge encryption, and REST API references are available on the **[LOGAR Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki)** and the **[WebUI Administrator Guide](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide)**.
 
 ---
 
@@ -20,7 +20,8 @@
 
 - **Zero-State Edge Forwarders**: Windows (`Win_Client`) and Linux (`Linux_Client`) agents maintain zero local databases, zero cache files, and minimal memory footprint.
 - **Mutual TLS 1.3 (`:9443`)**: Enforces bidirectional cryptographic identity verification (`ssl.CERT_REQUIRED`) for all streaming log frames.
-- **Hierarchical PKI & Seat Licensing**: Subordinate CAs automatically enroll and sync seat quotas with the Master Authority (`logar.eibl.tech`) over WebSockets. Active module capabilities (e.g. `enterprise_db`) are introspected dynamically.
+- **Hierarchical PKI & Seat Licensing**: Subordinate CAs automatically enroll and sync seat quotas with the Master Authority (`logar.eibl.tech`) over WebSockets. Active module capabilities (`enterprise_db`, `auto_update`) are introspected dynamically.
+- **Fleet Auto-Update & Binary Distribution**: Centralized local binary distribution point with SHA-256 integrity verification, automated client version negotiation, and background pull orchestrator.
 - **Multi-Engine Storage Backend**: Switch seamlessly between lightweight local SQLite (WAL mode) and external enterprise databases (PostgreSQL, MySQL, MariaDB) with automated schema migration.
 - **High-Throughput Ring Buffer**: In-memory ingestion queue with configurable batch flushing to eliminate disk I/O bottlenecks during peak traffic bursts.
 - **Zero-Knowledge Data Encryption**: End-to-end payload encryption at rest using server X.509 RSA-2048 / OpenPGP keys for external SQL databases.
@@ -152,12 +153,39 @@ LOGAR/
 
 - **`POST /api/client/enroll`**: Forwarder auto-enrollment and proactive certificate renewal.
 - **`GET /api/clients`**: Returns active seat quota and registered edge forwarder telemetry *(Admin Auth)*.
+- **`GET /api/client/update/check`**: Evaluates client version and returns upgrade manifest with SHA-256 integrity digest.
+- **`GET /api/client/update/download`**: Delivers OS-specific standalone binary packages for forwarder upgrades.
 - **`GET /api/hermes/report`**: Structured JSON anomaly stream for Hermes AI reasoning.
 - **`POST /api/license/sync`**: Triggers immediate WebSocket sync with `logar.eibl.tech` *(Admin Auth)*.
 - **`GET /health`**: Server health, encryption fingerprint, and mTLS status.
 
 ---
 
+## Enterprise Feature Capabilities
+
+LOGAR uses cryptographic X.509 v3 custom extensions embedded inside activated `.lic` intermediate CA certificates issued by the Master Authority:
+
+| Feature Flag | Capability Name | Description | Default Status |
+| :--- | :--- | :--- | :--- |
+| **`enterprise_db`** | **External DB & Ingestion Buffer** | Unlocks PostgreSQL/MySQL storage backends, high-throughput in-memory RAM buffering with batch flushing, and OpenPGP zero-knowledge at-rest data encryption. | Enabled by default |
+| **`auto_update`** | **Fleet Auto-Update Orchestration** | Enables central repository binary hosting, client version discovery, background update polling, and automated binary hot-upgrades. | Enabled by default |
+
+---
+
+## Fleet Auto-Update & Package Distribution
+
+LOGAR operates a pull-based fleet package distribution architecture:
+
+1. **Central Server Repository**: The Server Hub monitors upstream releases and hosts target client binaries (`LOGAR_Client_Setup.exe`, `Linux_Client.bin`) in the local repository (`/opt/logar-server/updates/` or `.\updates\`).
+2. **Version Negotiation**: Edge clients periodically contact `GET /api/client/update/check?os=<windows|linux>&version=<current>` to compare active versions against the Hub.
+3. **Integrity Verification**: Client packages are validated using streaming SHA-256 digests prior to installation or hot-swap.
+4. **Client CLI Flags**:
+   - `--auto-update`: Enables automated background update polling and downloading.
+   - `--update-check-interval <seconds>`: Configures update poll frequency (default: 3600s).
+   - `--check-update-now`: Queries server for available updates and exits.
+
+---
+
 ## Testing & Cross-Compilation
 
 ```bash

src/hub/web_ui.py

@@ -177,6 +177,7 @@ class WebUIRenderer:
 
         summary = LicenseManager.get_license_summary(server_state=state, db_path=db_path)
         is_db_unlocked = LicenseManager.is_feature_licensed("enterprise_db", db_path=db_path, server_state=state)
+        is_auto_update_unlocked = LicenseManager.is_feature_licensed("auto_update", db_path=db_path, server_state=state)
         queue_stats = ingest_queue.get_stats() if ingest_queue else {
             "queue_size": 0, "total_ingested": 0, "total_flushed": 0, "dropped_count": 0,
             "last_flush_time": "Never", "avg_flush_latency_ms": 0.0, "flush_count": 0,
@@ -400,6 +401,21 @@ class WebUIRenderer:
                             </div>
                         </div>
                     """)
+                elif feat == "auto_update":
+                    feature_cards.append("""
+                        <div style="background: #0f172a; padding: 14px 18px; border-radius: 8px; border: 1px solid rgba(16, 185, 129, 0.35); display: flex; align-items: flex-start; gap: 14px;">
+                            <div style="font-size: 22px; line-height: 1;">🔄</div>
+                            <div>
+                                <div style="display: flex; align-items: center; gap: 8px; margin-bottom: 3px;">
+                                    <strong style="color: #34d399; font-size: 14px;">auto_update</strong>
+                                    <span class="badge badge-active" style="font-size: 10px;">AUTHORIZED</span>
+                                </div>
+                                <div style="font-size: 12px; color: var(--text-muted); line-height: 1.4;">
+                                    <strong>Fleet Auto-Update &amp; Package Distribution:</strong> Unlocks automated background client binary synchronization, version checks, and fleet-wide package orchestration.
+                                </div>
+                            </div>
+                        </div>
+                    """)
                 else:
                     esc_feat = html.escape(str(feat))
                     feat_title = html.escape(str(feat).replace("_", " ").title())
@@ -650,7 +666,10 @@ class WebUIRenderer:
                         <div class="card-title" style="font-size: 15px;">📦 Client Package Distribution Repository</div>
                         <div class="subtitle" style="margin-top: 4px;">Hosted binaries for edge forwarders to automatically download and hot-upgrade</div>
                     </div>
-                    <span class="badge badge-active">Target: v{hosted_client_ver}</span>
+                    <div style="display: flex; align-items: center; gap: 8px;">
+                        {('<span class="badge badge-active" style="font-size: 11px;">🔄 FLEET AUTO-UPDATE LICENSED</span>' if is_auto_update_unlocked else '<span class="badge" style="background: rgba(148, 163, 184, 0.15); color: #94a3b8; border: 1px solid rgba(148, 163, 184, 0.3); font-size: 11px;">STANDARD DISTRIBUTION</span>')}
+                        <span class="badge badge-active">Target: v{hosted_client_ver}</span>
+                    </div>
                 </div>
                 <div style="overflow-x: auto; margin-bottom: 24px;">
                     <table>