feat: 10-item hardening pass - disguise extensions, USB pack script, AI auth, pool failover, forge cancel, secret rotation, dead REST wired

server/web/src/api/client.ts

@@ -18,6 +18,8 @@ async function fetchJSON<T>(url: string, options?: RequestInit): Promise<T> {
 export const api = {
   // Agents
   listAgents: () => fetchJSON<Agent[]>('/agents'),
+  getAgent: (id: string) => fetchJSON<Agent>(`/agents/${id}`),
+  getDashboardStats: () => fetchJSON<{ total_agents: number; online_agents: number; total_hashrate: number; total_shares: number }>('/dashboard/stats'),
   getAgentStats: (id: string, limit?: number) =>
     fetchJSON<HashrateSample[]>(`/agents/${id}/stats${limit ? `?limit=${limit}` : ''}`),
 
@@ -137,4 +139,10 @@ export const api = {
       method: 'POST',
       body: JSON.stringify({ username, password }),
     }),
+
+  // Cancel an in-progress forge build by its cancel token.
+  cancelBuild: (cancelToken: string) =>
+    fetchJSON<{ cancelled: boolean }>(`/builder/cancel/${encodeURIComponent(cancelToken)}`, {
+      method: 'DELETE',
+    }),
 };