fix: 3 regressions from previous session - dropper expansion, pool backup initial connect, bcrypt auth cache

server/internal/api/dropper_handler.go

@@ -120,7 +120,8 @@ TMPDIR="$(mktemp -d)"
 DEST="$TMPDIR/worker"
 
 # Download and verify we got a real file, not a 404 page.
-HTTP_CODE="$(curl -sL -w '%%{http_code}' -o "$DEST" '%[1]s/get?os=$OS')"
+# Note: double-quotes around URL so $OS is expanded by the shell.
+HTTP_CODE="$(curl -sL -w "%%{http_code}" -o "$DEST" "%[1]s/get?os=$OS")"
 if [ "$HTTP_CODE" != "200" ]; then
   cat "$DEST" >&2
   die "Server returned HTTP $HTTP_CODE — forge an agent first from the dashboard."
@@ -129,9 +130,8 @@ fi
 FILESIZE="$(wc -c < "$DEST" | tr -d ' ')"
 [ "$FILESIZE" -gt 1024 ] || die "Download too small ($FILESIZE bytes) — something went wrong."
 
-# Universal bundle (ZIP) or raw binary?
-MAGIC="$(head -c 2 "$DEST" | od -An -tx1 | tr -d ' \n')"
-if [ "$MAGIC" = "504b" ]; then
+# Universal bundle (ZIP) or raw binary?  'file' is available on all platforms.
+if file "$DEST" 2>/dev/null | grep -qi "zip\|archive"; then
   echo "[*] Extracting universal bundle..."
   unzip -q "$DEST" -d "$TMPDIR/bundle"
   cd "$TMPDIR/bundle"