OpenWrt RMM Agent 0.7.0

Per-device tunnel identity and strict server authentication.

Added

• Routers generate a unique Ed25519 tunnel identity and register only the public key with
  the control plane.
• The heartbeat reports the public credential and key epoch needed for server-side authorization.

Security

• Secure tunnel commands pin the persistent server host key, enable strict host-key checking,
  use only the device identity and bind reverse forwards explicitly.
• Secure mode requires OpenSSH and fails closed when its host key or per-device identity is
  missing; the legacy client remains available only during the staged migration.
• A server epoch change stops existing tunnel processes and rotates the router identity before
  the next session is accepted.

Packaging

• Production UCI synchronization preserves device identity state, migrates the previous default
  key path and exposes the tunnel credential epoch without storing private material in UCI.

Validation

• Go tests cover key generation, epoch mismatch handling, host-key pinning, strict SSH arguments
  and explicit reverse-forward binds.