fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

agent/deploy/subnet_test.go

@@ -0,0 +1,62 @@
+package deploy
+
+import (
+	"net"
+	"testing"
+)
+
+func TestGetSubnetIPv4(t *testing.T) {
+	if got := getSubnet("192.168.1.42"); got != "192.168.1" {
+		t.Fatalf("got %q", got)
+	}
+	if getSubnet("bad") != "" {
+		t.Fatal("invalid ip should return empty")
+	}
+	if getSubnet("10.0.0.1") != "10.0.0" {
+		t.Fatalf("got %q", getSubnet("10.0.0.1"))
+	}
+}
+
+func TestGetSubnetIPv6(t *testing.T) {
+	ip := "2001:db8:abcd:0012::1"
+	got := getSubnet(ip)
+	want := "2001:db8:abcd:12"
+	if got != want {
+		t.Fatalf("got %q want %q", got, want)
+	}
+	if getSubnet("::1") != "" {
+		t.Fatal("short IPv6 address should not yield sweep prefix")
+	}
+}
+
+func TestIPv4SweepHost(t *testing.T) {
+	host, ok := ipv4SweepHost("10.0.0", 42)
+	if !ok || host != "10.0.0.42" {
+		t.Fatalf("got %q ok=%v", host, ok)
+	}
+	if _, ok := ipv4SweepHost("2001:db8", 1); ok {
+		t.Fatal("IPv6 prefix should not produce sweep host")
+	}
+}
+
+func TestIsIPv4(t *testing.T) {
+	if !isIPv4("192.168.0.1") {
+		t.Fatal("expected IPv4")
+	}
+	if isIPv4("2001:db8::1") {
+		t.Fatal("expected not IPv4")
+	}
+}
+
+func TestGetLocalIPsSkipsLoopback(t *testing.T) {
+	ips := getLocalIPs()
+	for _, ip := range ips {
+		parsed := net.ParseIP(ip)
+		if parsed == nil {
+			t.Fatalf("invalid ip %q", ip)
+		}
+		if parsed.IsLoopback() {
+			t.Fatalf("loopback %q should be excluded", ip)
+		}
+	}
+}