merge fix/agent-public-addr: master-observed public IP resolution (V1.0.1)

internal/database/model/agent_node.go

@@ -48,6 +48,20 @@ type AgentNode struct {
 	// a telemetry object.
 	TelemetryAt int64 `json:"telemetryAt"`
 
+	// Seen source addresses (public-address resolution): the source IP of
+	// the agent's own authenticated requests, as observed by the master —
+	// the CF-Connecting-IP header when the agent comes through Cloudflare,
+	// else the direct peer address. An agent behind 1:1 NAT reports only
+	// its private interface address in telemetry (its public address is
+	// not assigned to any local interface, so enumeration can never see
+	// it); the observed source address is the master's view of the
+	// agent's public side. Writes are change-only (see
+	// AgentController.captureSeenIP); SeenIPAt is the unix-milli time of
+	// the last change, not of the last request.
+	SeenIPv4 string `json:"seenIpv4"`
+	SeenIPv6 string `json:"seenIpv6"`
+	SeenIPAt int64  `json:"seenIpAt"`
+
 	// One-click update (item 20): the master records an update intent here;
 	// the agent picks it up from its config poll, downloads + verifies +
 	// swaps its binary, restarts itself and reports the outcome back on