fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/api/fleet_handler_test.go

@@ -387,6 +387,32 @@ func TestFleetGetXMRPriceParseError(t *testing.T) {
 	}
 }
 
+func TestFleetGetXMRPriceRetriesOn429(t *testing.T) {
+	attempts := 0
+	setMockHTTPTransport(t, func(req *http.Request) (*http.Response, error) {
+		attempts++
+		rec := httptest.NewRecorder()
+		if attempts < 2 {
+			rec.WriteHeader(http.StatusTooManyRequests)
+			_, _ = rec.Write([]byte(`{"error":"rate limit"}`))
+			return rec.Result(), nil
+		}
+		rec.Header().Set("Content-Type", "application/json")
+		_, _ = rec.Write([]byte(`{"monero":{"usd":123.45}}`))
+		return rec.Result(), nil
+	})
+
+	fh, _, _, _ := newTestFleetHandler(t)
+	rec := httptest.NewRecorder()
+	fh.GetXMRPrice(rec, httptest.NewRequest(http.MethodGet, "/market/xmr", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200 after retry, got %d body %s", rec.Code, rec.Body.String())
+	}
+	if attempts < 2 {
+		t.Fatalf("expected retry on 429, attempts=%d", attempts)
+	}
+}
+
 func TestFleetEstimateXMRPerDay(t *testing.T) {
 	zero := EstimateXMRPerDay(0)
 	if zero["xmr_per_day"].(float64) != 0 {