Implement managed browser security, individual agents and observability

docs/company-branding.md

@@ -0,0 +1,32 @@
+# Company white label and start page
+
+Administrators configure the company name, color and PNG logo in the central
+console. Logo upload is decoded and re-encoded, bounded to 128 KiB and 1024 × 1024.
+SVG, remote image URLs and active content are not accepted. Publishing uses the
+existing signed versioned policy and independent review when configured.
+
+Branding appears on the browser start/new-tab page, sidebar, settings, enrollment,
+AI and password views; the native window title follows the company name. Website
+content remains unchanged. Remove the logo and publish to remove the custom artwork.
+Installer/executable branding remains the existing deployment build configuration;
+this policy changes the running browser UI without replacing the signed binary.
+
+Start page controls provide a heading, company message and optional RSS/Atom URL.
+News is centrally fetched, cached for one minute and refreshed by devices within
+five minutes or on policy changes. The shell displays at most 12 plain-text items
+and opens articles through normal managed navigation. Feed HTML and scripts are
+never inserted into the shell. Failures clear news without pausing browsing.
+
+Feeds require HTTPS on port 443, no embedded credentials, no redirects and bounded
+UTF-8 XML. Query parameters are supported. Do not put authentication tokens in feed
+URLs or policy. Private corporate feed hosts require exact deployment entries in
+`COMPANY_NEWS_ALLOWED_HOSTS` (comma separated). DNS addresses are validated and
+pinned per connection; loopback and mapped loopback destinations remain forbidden.
+Authenticated/SSO-only feeds need a future separately protected server credential
+integration; the current reader consumes feeds accessible to the management server.
+
+Policy fields: `brand.logoDataUrl` and `startPage.{title,subtitle,newsEnabled,feedUrl}`.
+News is obtained through the authenticated device route `/api/device/start-page/news`,
+bound to the effective policy version. The response contains title, HTTPS link and
+optional publication date, never raw XML. `startpage.news` exports timed backend
+OpenTelemetry spans without feed URL/body fields.