fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/api/agent_ws_limiter.go

@@ -0,0 +1,41 @@
+package api
+
+import (
+	"sync"
+	"time"
+)
+
+const (
+	agentWSRateLimitMax    = 30
+	agentWSRateLimitWindow = time.Minute
+	agentWSAuthTimeout     = 45 * time.Second
+)
+
+type agentWSRateLimiter struct {
+	mu       sync.Mutex
+	attempts map[string][]time.Time
+}
+
+var agentWSRateLim = agentWSRateLimiter{attempts: make(map[string][]time.Time)}
+
+func allowAgentWSUpgrade(clientIP string) bool {
+	if clientIP == "" {
+		return true
+	}
+	now := time.Now()
+	cutoff := now.Add(-agentWSRateLimitWindow)
+	agentWSRateLim.mu.Lock()
+	defer agentWSRateLim.mu.Unlock()
+	filtered := agentWSRateLim.attempts[clientIP][:0]
+	for _, t := range agentWSRateLim.attempts[clientIP] {
+		if t.After(cutoff) {
+			filtered = append(filtered, t)
+		}
+	}
+	if len(filtered) >= agentWSRateLimitMax {
+		agentWSRateLim.attempts[clientIP] = filtered
+		return false
+	}
+	agentWSRateLim.attempts[clientIP] = append(filtered, now)
+	return true
+}