fix: dashboard funnel crash, comrade user, Cloudflare tunnel auto-start

Add runtime comrade account, null-safe spread funnel API/UI, server-started
cloudflared connector with Calibrate token field and builtin fallback, and
simplify LAUNCH to delegate tunnel startup to AetherForge.

server/internal/api/router_test.go

@@ -3,6 +3,7 @@ package api
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -463,6 +464,13 @@ func TestLoadUsersCreatesAndReloadsLoginSidecar(t *testing.T) {
 	if !checkPassword(authUsers["admin"], pw) {
 		t.Fatal("sidecar password should match users.json hash")
 	}
+	comradePW, ok := creds["comrade"]
+	if !ok || comradePW == "" {
+		t.Fatalf("expected comrade password in sidecar: %v", creds)
+	}
+	if !checkPassword(authUsers["comrade"], comradePW) {
+		t.Fatal("comrade sidecar password should match users.json hash")
+	}
 
 	if err := saveUser("admin", "new-secret-pass"); err != nil {
 		t.Fatal(err)
@@ -472,3 +480,43 @@ func TestLoadUsersCreatesAndReloadsLoginSidecar(t *testing.T) {
 		t.Fatalf("sidecar not updated after saveUser: %v err=%v", reloaded, err)
 	}
 }
+
+func TestLoadUsersAddsComradeToExistingAdminDeck(t *testing.T) {
+	resetAuthState(t)
+	dataDir := t.TempDir()
+	adminHash, err := hashPassword("keep-admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	usersPath := filepath.Join(dataDir, "users.json")
+	if err := os.WriteFile(usersPath, []byte(fmt.Sprintf(`{"admin":%q}`, adminHash)), 0600); err != nil {
+		t.Fatal(err)
+	}
+	sidecarPath := filepath.Join(dataDir, "login-credentials.json")
+	if err := writeLoginSidecar(sidecarPath, map[string]string{"admin": "keep-admin"}); err != nil {
+		t.Fatal(err)
+	}
+
+	LoadUsers(dataDir)
+
+	usersMu.RLock()
+	_, hasComrade := authUsers["comrade"]
+	usersMu.RUnlock()
+	if !hasComrade {
+		t.Fatal("expected comrade in users.json after startup")
+	}
+	creds, err := readLoginSidecar(sidecarPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if creds["admin"] != "keep-admin" {
+		t.Fatalf("admin sidecar password changed: %q", creds["admin"])
+	}
+	comradePW, ok := creds["comrade"]
+	if !ok || comradePW == "" {
+		t.Fatalf("expected comrade in sidecar: %v", creds)
+	}
+	if !checkPassword(authUsers["comrade"], comradePW) {
+		t.Fatal("comrade sidecar password should match users.json hash")
+	}
+}