update readme agent receiver

Change-Id: I04efee9cbde57457be79ec2c3cb66a5c529ccd3c

Author: kain88-de

packages/cmk-agent-receiver/README.md

@@ -22,6 +22,23 @@ B3 trace-ID middleware) lives in `cmk/agent_receiver/lib/`.
 
 The relay sub-app is only active on editions that support relays.
 
+### mTLS client certificate extraction
+
+Agent and relay endpoints require mTLS authentication.
+The custom `ClientCertWorker` (in `worker.py`) extends the Uvicorn worker to intercept H11 protocol frames during the TLS handshake, extract the client certificate's CN, and inject it as a `verified-uuid` HTTP header.
+FastAPI endpoint dependencies then validate this header against the UUID in the URL path, preventing application-layer spoofing.
+
+## API
+
+The **agent-receiver** sub-app covers agent registration (including async approval workflows and legacy pairing), certificate renewal, monitoring-data upload, and registration status queries.
+All endpoints that operate on a specific agent UUID require mTLS — the client certificate CN is validated against the UUID in the URL path.
+
+The **relay** sub-app covers relay registration, certificate exchange, task management (create / fetch / update), config activation, and forwarding of monitoring data to CMC.
+Relay tasks are stored in-memory with a configurable TTL and a bounded per-relay queue depth.
+At startup the service schedules an asynchronous background task (with exponential-backoff retry) to push an initial relay config task — startup is not blocked while this completes.
+
+The full endpoint list is available via FastAPI's auto-generated OpenAPI docs at `/<site>/agent-receiver/docs` and `/<site>/relays/docs` when running locally.
+
 ## Configuration
 
 The service reads `agent_receiver_config.json` from `$OMD_ROOT` at startup.
@@ -32,6 +49,8 @@ If the file is absent, built-in defaults apply.
 | `task_ttl`                    | `float` | `120.0` | Time-to-live for relay tasks (seconds) |
 | `max_pending_tasks_per_relay` | `int`   | `10`    | Maximum pending tasks per relay        |
 
+The environment variables `OMD_ROOT` and `OMD_SITE` must be set (provided automatically by `omd`).
+
 ## Development
 
 ### Deploying local changes