[AZ-181] Final impl report

Made-with: Cursor

_docs/02_tasks/todo/AZ-183_resources_table_update_api.md

@@ -0,0 +1,66 @@
+# Resources Table & Update Check API
+
+**Task**: AZ-183_resources_table_update_api
+**Name**: Resources Table & Update Check API
+**Description**: Add Resources table to admin API PostgreSQL DB and implement POST /get-update endpoint for fleet OTA updates
+**Complexity**: 3 points
+**Dependencies**: None
+**Component**: Admin API
+**Tracker**: AZ-183
+**Epic**: AZ-181
+
+## Problem
+
+The fleet update system needs a server-side component that tracks published artifact versions and tells devices what needs updating. CI/CD publishes encrypted artifacts to CDN; the server must store metadata (version, URL, hash, encryption key) and serve it to devices on request.
+
+## Outcome
+
+- Resources table stores per-artifact metadata populated by CI/CD
+- Devices call POST /get-update with their current versions and get back only what's newer
+- Server-side memory cache handles 2000+ devices polling every 5 minutes without DB pressure
+
+## Scope
+
+### Included
+- Resources table migration (resource_name, dev_stage, architecture, version, cdn_url, sha256, encryption_key, size_bytes, created_at)
+- POST /get-update endpoint: accepts device's current versions + architecture + dev_stage, returns only newer resources
+- Server-side memory cache invalidated on CI/CD publish
+- Internal endpoint or direct DB write for CI/CD to publish new resource versions
+
+### Excluded
+- CI/CD pipeline changes (AZ-186)
+- Loader-side update logic (AZ-185)
+- Device provisioning (AZ-187)
+
+## Acceptance Criteria
+
+**AC-1: Resources table created**
+Given the admin API database
+When the migration runs
+Then the Resources table exists with all required columns
+
+**AC-2: Update check returns newer resources**
+Given Resources table has annotations version 2026-04-13
+When device sends POST /get-update with annotations version 2026-02-25
+Then response includes annotations with version, cdn_url, sha256, encryption_key, size_bytes
+
+**AC-3: Current device gets empty response**
+Given device already has the latest version of all resources
+When POST /get-update is called
+Then response is an empty array
+
+**AC-4: Memory cache avoids repeated DB queries**
+Given 2000 devices polling every 5 minutes
+When POST /get-update is called repeatedly
+Then the latest versions are served from memory cache, not from DB on every request
+
+**AC-5: Cache invalidated on publish**
+Given a new resource version is published via CI/CD
+When the publish endpoint/function completes
+Then the next POST /get-update call returns the new version
+
+## Constraints
+
+- Must integrate with existing admin API (linq2db + PostgreSQL)
+- encryption_key column must be stored securely (encrypted at rest in DB or via application-level encryption)
+- Response must include encryption_key only over HTTPS with valid JWT