feat: Add SentinelOne integration

- Add SentinelOne API client (lib/services/sentinelone-client.ts)
  - Paginated fetching for sites, agents, threats
  - JWT token auth via S1_API_URL / S1_API_TOKEN env vars

- Add SentinelOne sync service (lib/services/sentinelone-sync-service.ts)
  - Full sync: sites, agents, threats into s1_* tables
  - Sync history tracking with per-entity results

- Add DB migration 038: s1_sites, s1_agents, s1_threats,
  s1_company_mappings, s1_sync_history tables

- Add API routes:
  - POST/GET /api/sentinelone/sync
  - GET/POST/DELETE /api/sentinelone/company-mappings
  - GET /api/sentinelone/coverage (fixed Cartesian product bug)

- Add UI pages:
  - /admin/sync/sentinelone — sync admin with history + stats
  - /sentinelone/coverage — AV coverage report per site
  - /sentinelone/mappings — map S1 sites to Autotask companies

- Wire SentinelOne into admin sync overview card grid
- Add SentinelOne Sync to app navigation
- Fix docker-compose: remove explicit S1 env var entries that
  were overwriting env_file values with empty strings

components/navigation/app-navigation.tsx

@@ -15,6 +15,12 @@ import {
   Activity,
   HardDrive,
   Workflow,
+  GitBranch,
+  Sparkles,
+  Bell,
+  Zap,
+  Radio,
+  Shield,
 } from 'lucide-react';
 import {
   NavigationMenu,
@@ -77,6 +83,12 @@ const navigationItems: NavItem[] = [
         icon: Globe,
         description: 'Map RMM sites to companies'
       },
+      {
+        title: 'Zabbix WAN Monitor',
+        href: '/admin/zabbix-wan',
+        icon: Radio,
+        description: 'Sync RMM site WAN IPs to Zabbix with Autotask routing'
+      },
       {
         title: 'Apple RMM Mapping (Addigy)',
         href: '/addigy-mappings',
@@ -84,11 +96,47 @@ const navigationItems: NavItem[] = [
         description: 'Map Addigy devices to companies'
       },
       {
-        title: 'Workflow Engine',
+        title: 'Ticket Workflows',
         href: '/admin/workflow',
         icon: Workflow,
         description: 'Automated ticket triage and classification'
       },
+      {
+        title: 'Classification Rules',
+        href: '/admin/workflow/classification-rules',
+        icon: GitBranch,
+        description: 'Keyword-based classification rules'
+      },
+      {
+        title: 'AI Templates',
+        href: '/admin/workflow/ai-templates',
+        icon: Sparkles,
+        description: 'AI prompt templates for enhancement'
+      },
+      {
+        title: 'Webhook Pipelines',
+        href: '/admin/workflow/pipelines',
+        icon: Zap,
+        description: 'Automated webhook processing workflows'
+      },
+      {
+        title: 'Notification Channels',
+        href: '/admin/workflow/channels',
+        icon: Bell,
+        description: 'Teams, Telegram, and webhook notifications'
+      },
+      {
+        title: 'IT Glue Sync',
+        href: '/admin/sync/itglue',
+        icon: Shield,
+        description: 'IT Glue documentation backup — organizations, configs, passwords, flexible assets'
+      },
+      {
+        title: 'SentinelOne Sync',
+        href: '/admin/sync/sentinelone',
+        icon: Shield,
+        description: 'SentinelOne EDR — sites, agents, threats sync'
+      },
       {
         title: 'Data Browser',
         href: '/admin/data-browser',