feat: add scripts/enroll_local.py and update task 40 documentation

CHANGELOG.md

@@ -49,6 +49,7 @@ By: Codex (GPT-5)
 | 30.12.2025 | 🎨 UI | ID: TASK_000039 Login-Text reduziert, Buttons symmetrisch, Panels/Metrics harmonisiert. By: Codex (GPT-5) |
 | 30.12.2025 | 🏗️ Planning | ID: EPIC_000010/US_000034/US_000035 Update-Service v1 Migration dokumentiert. By: Codex (GPT-5) |
 | 30.12.2025 | 🏗️ Planning | ID: TASK_000040/TASK_000041 fuer Enrollment und v1 Endpunkte angelegt. By: Codex (GPT-5) |
+| 12.01.2026 | ⚙️ Code | ID: TASK_000040 Enrollment-Skript bereinigt und als scripts/enroll_local.py hinzugefuegt. By: Gemini CLI |
 
 ---
 ## Legende

project-management/requirements/tasks/TASK_000040.md

@@ -5,6 +5,9 @@ By: Codex (GPT-5)
 
 ## Outcome
 Der Update-Client kann einmalig per Enrollment einen Langzeit-Token beziehen und lokal speichern.
+Dazu stehen zwei Skripte zur Verfuegung:
+- `scripts/enroll_local.py`: Enrollment ueber die lokale API (empfohlen).
+- `scripts/manual_enroll.py`: Direktes Enrollment beim Update-Service (Bypass).
 
 ## Story-Bezug
 US_000034

scripts/enroll_local.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+import argparse
+import os
+import sys
+import httpx
+
+def enroll():
+    parser = argparse.ArgumentParser(description="Enroll this device via the local Kiddo API")
+    parser.add_argument("--url", default=os.getenv("API_URL", "http://localhost:8000"), help="Local API URL")
+    parser.add_argument("--token", help="Enrollment Token (from update service)")
+    parser.add_argument("--auth", help="Local Admin Auth Token (skd_session cookie value)")
+    
+    args = parser.parse_args()
+    
+    # Use default token if not provided (keeping the one from the prototype for now as a fallback)
+    enroll_token = args.token or "739772f5-4803-4635-a2c2-454799c37534"
+    
+    print(f"[*] Enrolling via local API at {args.url}")
+    print(f"[*] Enrollment Token: {enroll_token[:8]}...")
+    
+    headers = {}
+    auth_token = args.auth or os.getenv("SKD_API_TOKEN")
+    if auth_token:
+        headers["Cookie"] = f"skd_session={auth_token}"
+        print("[*] Using provided authentication token")
+    else:
+        print("[!] No authentication token provided. Request might fail if API is protected.")
+
+    try:
+        response = httpx.post(
+            f"{args.url}/update/enroll",
+            json={"enroll_token": enroll_token},
+            headers=headers,
+            timeout=15.0
+        )
+        
+        if response.status_code == 200:
+            print("[+] Success: Enrollment successful!")
+            print(f"[+] Response: {response.json()}")
+        elif response.status_code == 401:
+            print("[!] Error: Unauthorized. Please provide a valid admin auth token via --auth or SKD_API_TOKEN env.")
+        else:
+            print(f"[!] Error {response.status_code}: {response.text}")
+            sys.exit(1)
+
+    except Exception as e:
+        print(f"[!] Exception: {e}")
+        sys.exit(1)
+
+if __name__ == "__main__":
+    enroll()