test coverage improvements; mTLS enforcement; agent broke :(

evidence/diagrams/access-sync-flow.mmd

@@ -0,0 +1,19 @@
+sequenceDiagram
+  participant U as User
+  participant K as Keywarden
+  participant A as Agent
+  participant S as Server
+
+  U->>K: Upload SSH public key
+  K->>K: Issue SSH user certificate
+  U->>K: Request server access
+  Admin->>K: Approve access request
+  A->>K: Poll heartbeat/accounts/ssh-ca
+  K-->>A: Approved users + CA public key
+  A->>S: Enforce accounts + SSH CA trust
+  U->>S: SSH using key + certificate
+  K->>K: Revoke/expire access
+  A->>K: Next poll cycle
+  K-->>A: Updated account state
+  A->>S: Remove or lock account access
+

evidence/diagrams/architecture.mmd

@@ -0,0 +1,13 @@
+flowchart LR
+  User[User Browser] --> Web[Keywarden UI/API]
+  Admin[Admin Browser] --> Web
+  Web <--> IdP[OIDC Provider]
+  Web --> PG[(PostgreSQL)]
+  Web --> Cache[(Valkey/Redis)]
+  Web --> CA[(SSH User CA)]
+  Agent[Linux Agent] --> Web
+  Agent --> SSH[Managed Server SSHD]
+  User --> SSH
+  Web -. optional .-> Shell[Browser Shell WS Proxy]
+  Shell --> SSH
+

evidence/diagrams/deployment.mmd

@@ -0,0 +1,19 @@
+flowchart TB
+  subgraph DockerCompose
+    Nginx[Nginx]
+    Gunicorn[Gunicorn Django]
+    Daphne[Daphne WebSocket]
+    Celery[Celery Worker/Beat]
+    Redis[Valkey/Redis]
+  end
+
+  Nginx --> Gunicorn
+  Nginx --> Daphne
+  Gunicorn --> PG[(Keywarden PostgreSQL)]
+  Celery --> PG
+  Gunicorn --> Redis
+  Celery --> Redis
+  Agent[Agent on Managed Host] --> Nginx
+  Browser[User/Admin Browser] --> Nginx
+  IdP[Authentik/OIDC] --> Nginx
+

evidence/diagrams/erd.mmd

@@ -0,0 +1,11 @@
+erDiagram
+  USER ||--o{ SSHKEY : owns
+  SSHKEY ||--o{ SSHCERTIFICATE : signs
+  USER ||--o{ ACCESSREQUEST : requests
+  SERVER ||--o{ ACCESSREQUEST : targets
+  SERVER ||--o{ SERVERACCOUNT : contains
+  USER ||--o{ SERVERACCOUNT : maps_to
+  SERVER ||--o{ SERVERAUDITLOG : ingests
+  SERVER ||--o{ TELEMETRYEVENT : emits
+  USER ||--o{ AUDITLOG : performs
+