fix: pool backup failover on reconnect, perfect dropper scripts, bcrypt password hashing

server/internal/api/websocket.go

@@ -405,29 +405,31 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				if poolCfg.Password == "" {
 					poolCfg.Password = "x"
 				}
-				if _, err := h.poolManager.EnsurePool(&poolCfg); err != nil {
-					log.Printf("[WS] Primary pool unreachable for agent %s: %v — trying backup pools", agentID, err)
-					connected := false
-					for i, bp := range backupPools {
-						if bp.Host == "" || bp.Port <= 0 {
-							continue
-						}
-						bpCfg := poolCfg
-						bpCfg.Host = bp.Host
-						bpCfg.Port = bp.Port
-						bpCfg.UseTLS = bp.TLS
-						if bp.Pass != "" {
-							bpCfg.Password = bp.Pass
-						}
-						if _, err2 := h.poolManager.EnsurePool(&bpCfg); err2 == nil {
-							log.Printf("[WS] Connected agent %s to backup pool #%d (%s:%d)", agentID, i+1, bp.Host, bp.Port)
-							connected = true
-							break
-						}
+
+				// Build backup pool.Config list from what the agent sent at auth.
+				// These are registered on the proxy so reconnect() rotates through
+				// them automatically — not just at initial connect.
+				var backupCfgs []pool.Config
+				for _, bp := range backupPools {
+					if bp.Host == "" || bp.Port <= 0 {
+						continue
 					}
-					if !connected {
-						log.Printf("[WS] All pools failed for agent %s — agent will mine when pool reconnects", agentID)
+					bpc := pool.Config{
+						Host:   bp.Host,
+						Port:   bp.Port,
+						UseTLS: bp.TLS,
+						Wallet: poolCfg.Wallet,
 					}
+					if bp.Pass != "" {
+						bpc.Password = bp.Pass
+					} else {
+						bpc.Password = poolCfg.Password
+					}
+					backupCfgs = append(backupCfgs, bpc)
+				}
+
+				if _, err := h.poolManager.EnsurePoolWithBackups(&poolCfg, backupCfgs); err != nil {
+					log.Printf("[WS] All pools failed for agent %s (%d backups tried) — agent will mine when pool reconnects", agentID, len(backupCfgs))
 				}
 			}