Show posture values and report history

Pass/fail was the main device UI signal, but operators need
the agent's observed value. Expose a formatted value per
check, show current postures on the device page, and replace
the Postures tab with paginated report history grouped by
agent push time. Status stays in the model for later rulesets.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/agent/v1/agent.go

@@ -36,6 +36,7 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/bearertoken"
 	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/itam"
 	"go.probo.inc/probo/pkg/server/api/agent/v1/types"
 	"go.probo.inc/probo/pkg/server/jsonx"
@@ -177,15 +178,33 @@ func (h *Handler) handlePostures(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	fallbackCorrelationID := gid.New(
+		dev.ID.TenantID(),
+		coredata.DevicePostureReportEntityType,
+	)
+
 	results := make([]itam.RecordPostureResult, 0, len(req.Results))
 	for _, pr := range req.Results {
+		correlationID := fallbackCorrelationID
+
+		if pr.CorrelationID != "" {
+			parsed, err := gid.ParseGID(pr.CorrelationID)
+			if err != nil {
+				jsonx.RenderBadRequest(w, errors.New("correlation_id is invalid"))
+				return
+			}
+
+			correlationID = parsed
+		}
+
 		results = append(
 			results,
 			itam.RecordPostureResult{
-				CheckKey:   pr.CheckKey,
-				Status:     pr.Status,
-				Evidence:   pr.Evidence,
-				ObservedAt: pr.ObservedAt,
+				CheckKey:      pr.CheckKey,
+				Status:        pr.Status,
+				Evidence:      pr.Evidence,
+				ObservedAt:    pr.ObservedAt,
+				CorrelationID: correlationID,
 			},
 		)
 	}
@@ -198,6 +217,13 @@ func (h *Handler) handlePostures(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
+		if errors.Is(err, itam.ErrCorrelationIDRequired) ||
+			errors.Is(err, itam.ErrInvalidCorrelationIDEntityType) ||
+			errors.Is(err, itam.ErrInvalidCorrelationIDTenant) {
+			jsonx.RenderBadRequest(w, err)
+			return
+		}
+
 		h.logger.ErrorCtx(r.Context(), "cannot record postures", log.Error(err))
 		jsonx.RenderInternalServerError(w)