OpenWrt RMM Server 0.10.0

Secure cloud tunnels and responsive LAN inventory.

Added

• The control plane stores a unique Ed25519 public-key fingerprint and rotation epoch for
  every router while the private key remains on the device.
• The SSH sidecar resolves authorized keys through a token-protected internal endpoint and
  limits each credential to the ports of its active, non-expired remote session.
• Remote session creation reserves ports transactionally and enforces per-device concurrent
  session and creation-rate limits.
• Device transfers revoke the previous tunnel credential and advance its key epoch so the
  router rotates its identity on the next heartbeat.

Changed

• Secure tunnel commands include the persistent SSH host public key and require strict host-key
  verification from compatible agents.
• The stable agent advertised by server images is now 0.7.0.
• The LAN client table uses flexible columns at 1366×768, keeps status markers aligned, and
  truncates long values without introducing horizontal scrolling.

Fixed

• WAN neighbours are no longer presented as LAN clients.
• Duplicate tunnel-port reservations are rejected instead of allowing ambiguous forwarding.

Deployment

• Deploy server and agent 0.7.0 first with RMM_TUNNEL_AUTH_TOKEN empty, wait for router
  heartbeats to register per-device keys, then configure the shared internal auth token and
  persistent RMM_TUNNEL_HOST_PUBLIC_KEY during a maintenance window.

Validation

• Go tests cover credential registration, epoch rotation, transfer revocation, authenticated
  key lookup, port collisions and session limits.
• Browser tests cover the LAN client table at Full HD and 1366×768 without page or list overflow.