fix: dashboard funnel crash, comrade user, Cloudflare tunnel auto-start

Add runtime comrade account, null-safe spread funnel API/UI, server-started
cloudflared connector with Calibrate token field and builtin fallback, and
simplify LAUNCH to delegate tunnel startup to AetherForge.

README.md

@@ -235,7 +235,7 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe
 
 **Commands:** `tunnel_cloudflared`, `tunnel_wireguard`, `tunnel_ssh_forward`, `tunnel_status`, `tunnel_stop` (legacy: `start_tunnel`).
 
-**Calibrate:** `tunnel_defaults.cloudflared_target_url` defaults from `server.public_url`.
+**Calibrate:** `tunnel_defaults.cloudflared_target_url` defaults from `server.public_url`. **Cloudflare Tunnel Token** (Zero Trust connector) is saved to `config.json` and `data/cloudflared-token.txt`; the server starts `cloudflared tunnel run --token …` automatically on launch (USB `LAUNCH.bat` or `AetherForge.exe`). In Cloudflare, point the tunnel service to `http://localhost:8989` (or your listen port).
 
 **Future (not implemented):** server-side TCP reverse relay via `tunnel_stream` WebSocket — documented for localhost dashboard testing only.
 
@@ -250,7 +250,7 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe
 
 2. Browser opens **http://localhost:8989**
 
-3. **Sign in** — first run: check the console window for your generated admin password
+3. **Sign in** — first run: check the console window for **admin** and **comrade** passwords (both auto-created)
 
 4. **Calibrate** → wallet + pool + public URL; optional **Telegram** bot token + chat ID for fleet pings
 
@@ -264,8 +264,10 @@ AetherForge exposes **legitimate operator tunneling** for machines you administe
 
 ```
 === First Run ===
-Dashboard login:  admin / <random-password>
-Save this — it is not shown again.  Change it in Calibrate → Users.
+Dashboard logins (random passwords on first run):
+  admin   — primary operator
+  comrade — second account (created at startup if missing)
+Saved in data/login-credentials.json. Change passwords in Calibrate → Users.
 =================
 ```
 
@@ -574,7 +576,7 @@ By using this software you agree that:
 
 ### Security responsibility
 
-- `data/users.json` stores **bcrypt hashes only**. First-run generates a random admin password (shown once).
+- `data/users.json` stores **bcrypt hashes only**. First-run generates random passwords for **admin** and **comrade** (shown once in the console and `data/login-credentials.json`). Existing decks gain **comrade** automatically on the next server start if that account is missing.
 - Protect the dashboard with strong passwords and network isolation. Do not expose port 8989 to the open internet.
 - Remote command features (`powershell`, `exec`, file upload) are **full control** of a worker.
 - Code signing, Defender exclusions, and network segmentation are **your** responsibility.