feat: signed releases and a host-side updater for container nodes

CI signs the image digest of each agent and probe release; the panel only
stores and forwards it. Nodes write the manifest to their data directory and
a host updater verifies the signature with a local public key, pulls by
digest, restarts the unit and rolls back when it is unhealthy. The panel can
list releases, ask a node to update and show the reported update state.

backend/src/Monitor.Backend.Api/Admin/BuildEndpoints.cs

@@ -1,11 +1,13 @@
+using Fleet.Core;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
 using Monitor.Backend.Application;
+using Monitor.Protocol;
 
 namespace Monitor.Backend.Api;
 
-/// <summary>管理端的构建信息：后端自己和每个 Agent、Probe 的版本、tag、提交、构建时间（节点上报的，不含任何地址）。</summary>
+/// <summary>构建信息与更新：后端和每个节点的版本、tag、构建时间，CI 签名的发布清单，以及「更新这个节点」的请求。更新本身由节点宿主机上的更新器验签并执行。</summary>
 public static class BuildEndpoints
 {
     private const string Tag = "admin-build";
@@ -13,18 +15,44 @@ public static class BuildEndpoints
     public static void Map(RouteGroupBuilder group)
     {
         group.MapGet("/build-info", GetAsync)
-            .Api("build_info_get", "Version, tag, commit and build time of the backend and every agent and probe", Tag)
+            .Api("build_info_get", "Version, tag, commit, build time and update state of the backend and every agent and probe", Tag)
             .Returns<BuildInfoDto>().ProducesProblems(401, 403);
+        group.MapGet("/releases", ListReleasesAsync)
+            .Api("releases_list", "The latest signed release manifest of each component", Tag).Returns<PageDto<ReleaseDto>>().ProducesProblems(401, 403);
+        group.MapPost("/releases", PublishReleaseAsync)
+            .Api("releases_publish", "Register a CI-signed release manifest; online nodes get it right away (their updaters verify the signature)", Tag)
+            .Returns<ReleaseDto>(StatusCodes.Status201Created).ProducesProblems(400, 401, 403, 409);
+        group.MapPost("/nodes/{id}/update", RequestUpdateAsync)
+            .Api("nodes_update", "Ask an online agent or probe to install the release it has been offered", Tag).Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403, 409);
     }
 
-    private static async Task<IResult> GetAsync(HttpContext http, NodeInfoService nodes, CancellationToken ct)
+    private static async Task<IResult> GetAsync(HttpContext http, NodeInfoService nodes, ReleaseService releases, CancellationToken ct)
     {
         var items = (await nodes.ListAsync(ct))
             .OrderBy(n => n.Kind, StringComparer.Ordinal)
             .ThenBy(n => n.NodeId, StringComparer.Ordinal)
-            .Select(n => new NodeBuildDto(n.NodeId, n.Kind, n.Os, n.OsName, n.Arch, n.Version, n.Tag, n.Commit, n.BuiltAt))
+            .Select(n => new NodeBuildDto(n.NodeId, n.Kind, n.Os, n.OsName, n.Arch, n.Version, n.Tag, n.Commit, n.BuiltAt, ToDto(releases.StatusOf(new NodeId(n.NodeId)))))
             .ToList();
         http.Response.Headers.CacheControl = "no-store";
         return TypedResults.Json(new BuildInfoDto(NodeEndpoints.Backend(withCommit: true), items), ApiJsonContext.Default.BuildInfoDto);
     }
+
+    private static async Task<IResult> ListReleasesAsync(ReleaseService releases, CancellationToken ct) =>
+        TypedResults.Json(new PageDto<ReleaseDto>([.. (await releases.ListAsync(ct)).Select(ToDto)], null), ApiJsonContext.Default.PageDtoReleaseDto);
+
+    private static async Task<IResult> PublishReleaseAsync(HttpContext http, ReleaseService releases, PublishReleaseRequest request)
+    {
+        Result<ReleaseOffer> result = await releases.PublishAsync(request.Manifest ?? "", request.Signature ?? "", http.RequestAborted);
+        return result.TryGet(out ReleaseOffer? offer, out FleetError? error)
+            ? TypedResults.Json(ToDto(offer), ApiJsonContext.Default.ReleaseDto, statusCode: StatusCodes.Status201Created)
+            : Problems.From(http, error);
+    }
+
+    private static async Task<IResult> RequestUpdateAsync(HttpContext http, ReleaseService releases, string id, CancellationToken ct) =>
+        await releases.RequestUpdateAsync(new NodeId(id), ct) ? TypedResults.NoContent() : Problems.Create(http, MonitorErrors.AgentOffline, "the node is not connected");
+
+    private static ReleaseDto ToDto(ReleaseOffer offer) => new(offer.Component, offer.Seq, offer.Tag, offer.Version, offer.Digest);
+
+    private static NodeUpdateDto? ToDto(UpdateStatus? status) =>
+        status is null ? null : new NodeUpdateDto(status.State, status.Current, status.Available?.Tag, status.Available?.Version, status.Error, status.At > 0 ? DateTimeOffset.FromUnixTimeSeconds(status.At) : null);
 }