feat: 10-item hardening pass - disguise extensions, USB pack script, AI auth, pool failover, forge cancel, secret rotation, dead REST wired

server/internal/api/agent_config.go

@@ -10,6 +10,16 @@ type AgentForgeConfig struct {
 	AIEnabled        bool
 	AIOllamaEndpoint string
 	AIModel          string
+	// BackupPools are tried in order if the primary pool is unreachable.
+	BackupPools []AgentBackupPool
+}
+
+// AgentBackupPool is a fallback pool config received from an agent at auth time.
+type AgentBackupPool struct {
+	Host string
+	Port int
+	TLS  bool
+	Pass string
 }
 
 func (c AgentForgeConfig) poolHostOrDefault(fallback string) string {