docs: document split-port agent ingest for operators (MSP isolation)

PULSE_AGENT_INGEST_PORT existed in code but was absent from operator-facing
docs, so the network-isolation feature (dedicated agent-ingest port serving
only /api/agents/*, firewalled from the web UI/management API) was
undiscoverable. Adds it to CONFIGURATION.md (env-var row + Split-Port Agent
Ingest section with the security model and agent wiring via
PULSE_AGENT_CONNECT_URL) and an API Security cross-reference in
AGENT_SECURITY.md. Also aligns WEBHOOKS.md multi-tenant licensing wording with
MULTI_TENANT.md / API.md (Enterprise license + multi_tenant capability).

docs/AGENT_SECURITY.md

@@ -149,3 +149,4 @@ Unified agent (`pulse-agent`):
 
 - **Token Authentication**: All agent-to-server communication requires a valid API token.
 - **TLS**: Encrypted by default (unless specifically disabled).
+- **Network Isolation (optional)**: Agent check-in can be served on a dedicated, separately firewalled port that exposes only the agent-ingest routes (`/api/agents/*`), so a host that can reach the agent endpoint over an untrusted network cannot pivot to the web UI or management API. See [Split-Port Agent Ingest](CONFIGURATION.md#split-port-agent-ingest-network-isolation).

docs/CONFIGURATION.md

@@ -198,7 +198,8 @@ Environment variables take precedence over `system.json`.
 
 | Variable | Description | Default |
 | ---------- | ------------- | --------- |
-| `FRONTEND_PORT` | Public listening port | `7655` |
+| `FRONTEND_PORT` | Public listening port (web UI, API, and agent ingest) | `7655` |
+| `PULSE_AGENT_INGEST_PORT` | Optional dedicated port that serves **only** agent ingest (`/api/agents/*`), network-isolated from the web UI and the rest of the API. `0` = disabled (single port). See [Split-Port Agent Ingest](#split-port-agent-ingest-network-isolation). | `0` |
 | `LOG_LEVEL` | Log verbosity (see below) | `info` |
 | `LOG_FORMAT` | Log output format (`auto`, `json`, `console`) | `auto` |
 | `LOG_FILE` | Log file path (enables file logging) | *(unset)* |
@@ -243,6 +244,31 @@ Environment variables take precedence over `system.json`.
 | `PULSE_TRUSTED_NETWORKS` | Comma-separated CIDRs treated as trusted local networks (does not bypass auth) | *(unset)* |
 | `ALLOW_UNPROTECTED_EXPORT` | Allow unauthenticated config export on public networks when no auth is configured (use with caution) | `false` |
 
+### Split-Port Agent Ingest (Network Isolation)
+
+By default Pulse serves the web UI, the REST API, and agent check-in together on `FRONTEND_PORT`. For deployments that expose Pulse to monitored hosts across an untrusted network (for example, a managed service provider whose clients' Proxmox nodes reach a central Pulse server over the internet), you can move agent check-in onto its own dedicated port and keep the web UI and management API on a separate, firewalled port.
+
+Set `PULSE_AGENT_INGEST_PORT` to a port other than `FRONTEND_PORT`:
+
+```bash
+PULSE_AGENT_INGEST_PORT=7656
+```
+
+When enabled:
+
+- The dedicated port serves **only** the agent-ingest routes (`/api/agents/*`). Every other path, including the web UI, login, and the management API, returns `404`. A host that can reach the agent port cannot pivot to the management interface.
+- The main `FRONTEND_PORT` listener is unchanged and still serves everything (including agent ingest), so existing single-port installs keep working. The dedicated listener is purely additive.
+- The value is validated at startup: it must be between 1 and 65535 and must differ from `FRONTEND_PORT` and the HTTP redirect port. An invalid value is rejected.
+
+Expose only `PULSE_AGENT_INGEST_PORT` to your monitored hosts and keep `FRONTEND_PORT` on a private network or behind your firewall/VPN. Point agents at the dedicated port by setting `PULSE_AGENT_CONNECT_URL` to that port's public address, so generated agent install commands send check-ins there:
+
+```bash
+PULSE_AGENT_INGEST_PORT=7656
+PULSE_AGENT_CONNECT_URL=https://agents.example.com:7656
+```
+
+Agents then post telemetry to `https://agents.example.com:7656/api/agents/agent/report`, while the web UI and management API remain reachable only on the private `FRONTEND_PORT` listener.
+
 ### Iframe Embedding (system.json)
 
 Embedding is controlled by `system.json` and the UI (**Settings → System → Network**):

docs/WEBHOOKS.md

@@ -77,7 +77,7 @@ Audit webhooks are dispatched asynchronously. The payload includes a `signature`
 
 ## 🏢 Multi-tenant / MSP and PSA integration
 
-In multi-tenant mode (Pulse Cloud, or self-hosted with `PULSE_MULTI_TENANT_ENABLED=true` and a multi-tenant license) alerts and notification destinations are isolated **per organization**. Every alert and webhook request resolves an organization and operates only on that org's own alert state and webhook config, so one client's destinations and templates never leak into another's.
+In multi-tenant mode (Pulse Cloud, or self-hosted with `PULSE_MULTI_TENANT_ENABLED=true` and an Enterprise license with the `multi_tenant` capability) alerts and notification destinations are isolated **per organization**. Every alert and webhook request resolves an organization and operates only on that org's own alert state and webhook config, so one client's destinations and templates never leak into another's.
 
 The organization for a request is resolved in this order: