feat: Add SentinelOne integration

- Add SentinelOne API client (lib/services/sentinelone-client.ts)
  - Paginated fetching for sites, agents, threats
  - JWT token auth via S1_API_URL / S1_API_TOKEN env vars

- Add SentinelOne sync service (lib/services/sentinelone-sync-service.ts)
  - Full sync: sites, agents, threats into s1_* tables
  - Sync history tracking with per-entity results

- Add DB migration 038: s1_sites, s1_agents, s1_threats,
  s1_company_mappings, s1_sync_history tables

- Add API routes:
  - POST/GET /api/sentinelone/sync
  - GET/POST/DELETE /api/sentinelone/company-mappings
  - GET /api/sentinelone/coverage (fixed Cartesian product bug)

- Add UI pages:
  - /admin/sync/sentinelone — sync admin with history + stats
  - /sentinelone/coverage — AV coverage report per site
  - /sentinelone/mappings — map S1 sites to Autotask companies

- Wire SentinelOne into admin sync overview card grid
- Add SentinelOne Sync to app navigation
- Fix docker-compose: remove explicit S1 env var entries that
  were overwriting env_file values with empty strings

docker-compose.yml

@@ -95,6 +95,23 @@ services:
       # Veeam VSPC Configuration
       VEEAM_VSPC_URL: ${VEEAM_VSPC_URL}
       VEEAM_VSPC_API_KEY: ${VEEAM_VSPC_API_KEY}
+
+      # Zabbix API Configuration
+      ZABBIX_API_URL: ${ZABBIX_API_URL}
+      ZABBIX_API_TOKEN: ${ZABBIX_API_TOKEN}
+
+      # ipinfo.io API token (optional)
+      IPINFO_TOKEN: ${IPINFO_TOKEN:-}
+
+      # IT Glue Configuration
+      ITGLUE_API_KEY: ${ITGLUE_API_KEY}
+      
+      # Backblaze B2 Storage (S3-compatible)
+      B2_KEY_ID: ${B2_KEY_ID}
+      B2_APP_KEY: ${B2_APP_KEY}
+      B2_BUCKET: ${B2_BUCKET:-wulf-audits}
+      B2_REGION: ${B2_REGION:-us-west-002}
+      B2_ENDPOINT: ${B2_ENDPOINT:-s3.us-west-002.backblazeb2.com}
       
       # Webhook Configuration
       WEBHOOK_BASE_URL: ${WEBHOOK_BASE_URL:-https://pulse.wulfconsulting.cloud}