Implement performance monitor

docs/AGENT-API-AUTH.md

@@ -1,7 +1,7 @@
 # Agent API authentication
 
 Reference for the per-device signature gate on the agent-facing HTTP
-API. Five endpoints are gated:
+API. Seven endpoints are gated:
 
 - `POST /api/heartbeat`
 - `POST /api/sysinfo`
@@ -11,6 +11,15 @@ API. Five endpoints are gated:
   by the agent. Same TOFU lifecycle as heartbeat / sysinfo: stock
   RustDesk doesn't post here at all, so in practice every caller is a
   managed agent; the legacy/unsigned path is kept for symmetry.
+- `POST /api/agent/metrics` — continuous CPU / memory / top-process
+  samples (≈1 / minute). Surfaced on the admin Devices detail page as
+  a 24 h sparkline + live snapshot card.
+- `POST /api/agent/perf-events` — sparse Windows-event-log entries
+  flagged by `Microsoft-Windows-Diagnostics-Performance/Operational`,
+  `Microsoft-Windows-Resource-Exhaustion-Detector/Operational`, and
+  hand-picked `System` IDs (41 / 6008 / 1001 — unexpected reboot /
+  dirty shutdown / BSOD). Server dedups via UNIQUE (peer_id, provider,
+  record_id).
 
 For the operator workflow — turning it on, the dashboard toggle, what
 happens when a managed agent is uninstalled — see the matching section