docs: update README with v3.0.1 architecture, 35 unit tests, and cross-compilation

README.md

@@ -267,17 +267,20 @@ stateDiagram-v2
   - Admin WebUI is protected by authenticated login with user and tenant administration.
 
 ### 3. Integrated Fleet Licensing & WebUI Dashboard
-- **WebUI URL**: Accessible at `http://<server_host>:8443/webui` (or `/`).
-- **Visual Seat Quota Meter**: Real-time progress bar displaying active forwarders vs. allocated seat limit.
-- **Licensing Actions**:
-  - 1-click **Export .lic Request** file download.
-  - Interactive **View & Copy CA CSR** modal.
-  - Drag-and-drop or paste **Import License (.lic / ca.crt)** modal.
-  - **Sync & Renew via mTLS** button for immediate upstream synchronization and seat expansion.
-- **Seat Management & Revocation Table**:
-  - Lists all connected Windows and Linux edge forwarders.
-  - **Revoke Seat**: Instantly drops and blocks the client at the TLS socket handshake layer.
-  - **Reactivate Seat**: Restores the client to active status if within seat quota limits.
+- **WebUI URL**: Accessible at `http://<server_host>:8443/webui` (or `/`). Protected by authenticated session login (`/login`).
+- **Tab 1: 📋 Active Anomalies & Telemetry**:
+  - Real-time tabular stream of verified anomalies within the active 12-hour evaluation window.
+  - Interactive search filter and Hermes AI status metrics.
+  - **Visual Seat Quota Meter**: Real-time progress bar displaying active forwarders vs. allocated seat limit.
+  - **Seat Management & Revocation Table**: Lists all connected Windows and Linux edge forwarders with 1-click **Revoke Seat**, **Reactivate Seat**, and **Export Client Configuration** actions.
+- **Tab 2: 📜 Sub-CA & Licensing**:
+  - Dedicated PKI and Subordinate CA lifecycle management interface.
+  - Displays Master Authority WebSocket status (`logar.eibl.tech`), hardware fingerprint, and embedded seat quota.
+  - **Licensing Actions**:
+    - 1-click **Export .lic Request** file download.
+    - Interactive **View & Copy CA CSR** modal.
+    - Drag-and-drop or paste **Import License (.lic / ca.crt)** modal.
+    - **Sync & Renew via WebSocket** button for immediate upstream synchronization and seat expansion.
 
 ### 4. Cloud-Side In-Flight Certificate Watchdog
 - **Continuous Hub PKI Watchdog**:
@@ -327,7 +330,7 @@ Client enrollment endpoint:
   ```
 
 ### `GET /api/clients`
-Returns seat quota status and registered client telemetry:
+Returns seat quota status and registered client telemetry *(Requires Administrator session cookie or Bearer auth)*:
 ```json
 {
   "active_seats": 2,
@@ -369,7 +372,10 @@ Returns all **verified anomalies** within the active 12-hour evaluation window w
 ```
 
 ### `GET /api/hermes/all`
-Diagnostic endpoint listing all tracked anomalies in SQLite.
+Diagnostic endpoint listing all tracked anomalies in SQLite *(Requires Administrator auth)*.
+
+### `POST /api/auth/login` & `POST /api/auth/logout`
+Session authentication endpoints for Administrator WebUI access.
 
 ### `GET /health`
 Returns hub health, encryption fingerprint, listener ports, and mTLS status.
@@ -422,15 +428,15 @@ LOGAR provides production-grade installation scripts and installer builders for
 LOGAR/
 ├── .gitea/
 │   └── workflows/
-│       ├── ci.yml                     # CI pipeline: syntax, 25 unit tests & mTLS pipeline test
-│       └── release.yml                # Consolidated release workflow (Linux binaries & Windows installers)
+│       ├── ci.yml                     # CI pipeline: syntax, 35 unit tests & mTLS pipeline test
+│       └── release.yml                # Consolidated release workflow (Cross-compilation on Linux runner)
 ├── compilation/                       # Packaging, installers, and release automation
 │   ├── install_linux_client.sh        # Automated Linux client systemd installation script
 │   ├── install_linux_server.sh        # Automated Linux server systemd installation script
 │   ├── installer_client.iss           # Inno Setup Windows Client installer script
 │   ├── installer_server.iss           # Inno Setup Windows Server installer script
 │   ├── nssm.exe                       # Official 64-bit NSSM service manager binary
-│   ├── package_dist.py                # Standalone binary compiler & packager
+│   ├── package_dist.py                # Standalone binary cross-compiler & packager
 │   ├── requirements.txt               # Unified project dependencies
 │   └── upload_release.py              # Gitea REST API release asset publisher
 ├── src/                               # Core application source modules
@@ -440,9 +446,10 @@ LOGAR/
 │   ├── Win_Client.py                  # Windows edge forwarder with auto-enrollment
 │   └── Linux_Client.py                # Linux edge forwarder with auto-enrollment
 ├── tests/                             # Automated test suites
+│   ├── test_license_authority.py      # Subordinate CA, WebSocket sync, and WebUI integration tests
 │   ├── test_linux_client.py           # Linux client unit tests & mTLS certificate validation
 │   ├── test_pipeline.py               # End-to-end mTLS integration & direct anomaly verification test
-│   ├── test_server.py                 # Server unit tests, PKI generation, and seat quota tests
+│   ├── test_server.py                 # Server unit tests, PKI generation, user auth & seat quota tests
 │   └── test_win_client.py             # Windows client unit tests & mTLS certificate validation
 ├── .gitignore                         # Ignores venv, caches, DBs, and private keys
 ├── README.md                          # Architecture and usage documentation
@@ -491,7 +498,7 @@ LOGAR/
    ```bash
    sudo ./compilation/install_linux_client.sh "http://<HUB_HOST>:8443" "<ENROLLMENT_SECRET>"
    ```
-2. The installer enrolls the client, configures `/etc/logar/certs`, and activates `logar-client.service`.
+2. The installer enrolls the client, configures `/etc/logar/certs` (with `chmod 700`), and activates `logar-client.service`.
 
 ---
 
@@ -501,11 +508,13 @@ LOGAR/
 ```bash
 python -m unittest discover -s tests -v
 ```
-Runs all **25 unit tests**, covering:
+Runs all **35 unit tests**, covering:
 - Dynamic Root CA generation and server TLS certificate issuance.
 - Dynamic client certificate issuance with CN and authority key extensions.
 - Enrollment secret authentication, seat limits, and certificate revocation.
 - Proactive certificate validity checks, Root CA auto-renewal, and in-flight server SSLContext reload.
+- Subordinate CA CSR generation, WebSocket enrollment, and dynamic seat quota updates.
+- Administrator session authentication, PBKDF2 hashing, and Hermes Bearer token lifecycle.
 - Windows & Linux event log collection, deduplication, and mTLS certificate verification.
 - 12-hour evaluation window and direct Hermes anomaly verification.
 
@@ -526,29 +535,30 @@ Tests client enrollment, secret rejection, mTLS TLS 1.3 socket handshake, direct
 
 ## Releases & Binary Distribution
 
-Releases can be built and published through three complementary channels:
+Releases are cross-compiled and published through automated or manual triggers:
 
 ### 1. Tag Push Automation (Gitea Actions)
-Pushing a release tag automatically triggers the build workflows:
+Pushing a release tag automatically triggers the build workflow:
 ```bash
-git tag v3.0.0
-git push origin v3.0.0
+git tag v3.0.1
+git push origin v3.0.1
 ```
-The consolidated workflow **`release.yml`** defines two parallel jobs:
-- **`release-linux`** (`ubuntu-latest`): Compiles standalone native ELF binaries (`Linux_Client.bin`, `Server.bin`) and checksums.
-- **`release-windows`** (`windows-latest`): Compiles Windows executables (`Win_Client.exe`, `Server.exe`), builds Inno Setup installers, and publishes checksums (requires self-hosted Windows Act Runner).
+The consolidated workflow **`release.yml`** runs on a single Ubuntu runner (`ubuntu-latest`) using cross-compilation (`python compilation/package_dist.py --target all`):
+- **Linux Binaries**: Native ELF standalone executables (`Linux_Client.bin`, `Server.bin`).
+- **Windows Executables & Bundles**: Cross-compiled standalone binaries (`Win_Client.exe`, `Server.exe`) and `.zip` distribution packages.
+- **Automated Checksums & Publishing**: Generates `sha256sums.txt` and publishes all release assets and release notes directly to Gitea.
 
 ### 2. Manual Workflow Dispatch (Gitea UI)
 Workflows can be manually triggered on demand from the Gitea web interface:
 1. Navigate to **Actions** $\rightarrow$ **Release Binaries & Installers** (`release.yml`).
-2. Click **Run workflow**, set the release tag (defaults to `v3.0.0`), and run.
+2. Click **Run workflow**, set the release tag (defaults to `v3.0.1`), and run.
 
-### 3. Native Local Windows Build & Direct Release Upload
-For environments without a registered Windows CI runner, Windows executables can be built and published directly to Gitea releases:
+### 3. Local Native Build & Direct Release Upload
+To build and upload binaries locally from an administrative workstation:
 ```powershell
-# 1. Build Windows binaries locally
-python compilation/package_dist.py --target windows
+# 1. Build binaries locally (windows, linux, or all)
+python compilation/package_dist.py --target all
 
 # 2. Upload assets and release notes directly to the Gitea release
-python compilation/upload_release.py --tag v3.0.0 --token <GITEA_TOKEN> --skip-build
+python compilation/upload_release.py --tag v3.0.1 --token <GITEA_TOKEN> --skip-build
 ```