Your post is hard to read at least for me since it is not formatted as described here. But I can identify an error since object Endpoint “satellite.localdomain” is defined twice at your satellite’s zones.conf.
No, that’s wrong. I’d suspect you mean a signing request.
No, node wizard sent a signing request via satellite to master. This request needs to be signed at the master only.
Normally, this information needs to be entered just one time.
I have no idea what your question is about. In general, only one api user user is required at the master for the communication between icingaweb and icinga.
No, the director is manging all zone and endpoint objects for agents automatically. There is nothing to do manually, hence, it’s not visible.
You could go to icinga on github.com and create issues and PRs accordingly.
I’ve no idea what does this mean. In general, an endpoint object belong to a zone no matter if mast, satellite or agent.
Satellite zone and endpoint objects need to be created manually by editing zones.conf and then be imported using kickstart wizard. For agents there is no manually action required.
Such a message report a successful (re-)connect:
… information/JsonRpcConnection: The certificate for CN ‘satellite.localdomain’ is valid and uptodate. Skipping automated renewal.