Agent:
- Role presets (web/db/mail/proxy/cache/broker) via 'set role to X'
- Trusted IP whitelist — never auto-blocked by brute-force detection
- Audit trail: JSON-lines to /var/log/sysadmin-agent/audit.log + syslog
- network check (60s): gateway ping + DNS
- failed_units check (2m): detect + restart failed systemd units
- brute: journalctl -u ssh -u sshd, threshold 5, skip trusted IPs
- brute_status() diagnostic command
- Auto-update: random 0-10min delay to prevent fleet thundering herd
- sysagent added to systemd-journal group on install
- _HANDLER_FORCE regex patterns fix routing for 'trust ip X',
  'remove sh from blacklist', 'set role to web', etc.
- Add missing commands to _HANDLER_CMDS (trust/untrust/role/brute/network/units)
- Fix trust_add regex: require 'allow ip' not bare 'allow'

Dashboard:
- Fleet summary strip: online/offline counts, avg CPU/MEM, alert count, EVA
- Agent cards sorted online-first
- network + failed_units checks added to autonomy countdown grid
- Alert severity coloring (red/yellow/blue borders)
- Global search repurposed to search chat log
- Empty states for no agents and no alerts
- clearAlerts() now asks for confirmation
- Alert body '!' lines coloured yellow (consistent with result blocks)
- Audit quick-action button on each agent card
- Role badge in agent card header and info row
- Scheduled update ETA shown in agent detail

Docs:
- README rewritten as clean GitHub intro page
- INSTALL.md rewritten: numbered sections, no MQTT internals, current config
- nginx-broker-setup.md simplified, note that install-broker handles it
- config.toml.example files updated to match current code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>