chore: update server-core submodule - fix TestDeviceCRUD panic

Test jobs failed because actions/checkout@v4 erases global insteadOf
during 'Setting up auth for fetching submodules', replacing it with
SSH mappings that don't help with x-access-token auth.

Fix: Add token + persist-credentials to checkout (same pattern as
reusable build workflows that pass), and move insteadOf after checkout
as a safety net for subsequent git operations.

.gitea/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - 'dev-*'
+      - 'v*-dev*'
       - 'v*-beta*'
       - 'v*-test*'
       - 'v[0-9]*.[0-9]*.[0-9]'
@@ -14,12 +15,14 @@ jobs:
     if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
-      - name: Configure git auth for submodules
-        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
       - uses: actions/checkout@v4
         with:
           submodules: true
           fetch-depth: 0
+          token: ${{ secrets.BUILD_TOKEN }}
+          persist-credentials: true
+      - name: Configure git auth for submodules
+        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
@@ -36,12 +39,14 @@ jobs:
     if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
-      - name: Configure git auth for submodules
-        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
       - uses: actions/checkout@v4
         with:
           submodules: true
           fetch-depth: 0
+          token: ${{ secrets.BUILD_TOKEN }}
+          persist-credentials: true
+      - name: Configure git auth for submodules
+        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
@@ -53,12 +58,14 @@ jobs:
     if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
-      - name: Configure git auth for submodules
-        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
       - uses: actions/checkout@v4
         with:
           submodules: true
           fetch-depth: 0
+          token: ${{ secrets.BUILD_TOKEN }}
+          persist-credentials: true
+      - name: Configure git auth for submodules
+        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
       - uses: actions/setup-node@v4
         with:
           node-version: '24'

AGENTS.md

@@ -13,7 +13,7 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 ├── apps/
 │   ├── server-core/    # Go/Gin API backend (submodule)
 │   ├── dashboard-ui/   # Vue 3 + Vite frontend (submodule)
-│   └── device-agent/   # Go stealth daemon (submodule)
+│   └── device-agent/   # Go stealth daemon + system tray (submodule)
 ├── docker-compose.yml  # Production orchestration
 ├── docker-compose.dev.yml  # Dev (air hot-reload)
 ├── Makefile            # up/down/dev/migrate/reset-db
@@ -50,7 +50,10 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 | Symbol | Type | Location | Role |
 |--------|------|----------|------|
 | `main()` (server-core) | func | `apps/server-core/main.go` | Entry: CLI flags + Gin init |
-| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: agent daemon lifecycle |
+| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: systray + agent daemon lifecycle |
+| `onReady()` / `onExit()` | func | `apps/device-agent/main.go` | System tray setup and cleanup |
+| `startAgent()` / `stopAgent()` | func | `apps/device-agent/main.go` | Agent connect/disconnect lifecycle |
+| `generateIcon()` | func | `apps/device-agent/icon.go` | 16x16 shield icon for tray |
 | `config.Load()` | func | `apps/server-core/internal/config/` | Env-based config loader |
 | `config.LoadConfFile()` | func | `apps/server-core/internal/config/config_loader.go` | Config file parser (.env / nexusguard.conf) |
 | `auth.Init()` | func | `apps/server-core/internal/auth/` | JWT sign/verify init |