fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/api/router_test.go

@@ -179,6 +179,52 @@ func TestBasicAuthMiddlewareWrongPassword(t *testing.T) {
 	if rec.Code != http.StatusUnauthorized {
 		t.Fatalf("expected 401, got %d", rec.Code)
 	}
+	if strings.Contains(rec.Header().Get("WWW-Authenticate"), "Basic") {
+		t.Fatal("SPA requests with Authorization must not get WWW-Authenticate")
+	}
+}
+
+func TestIsSPAAuthRequest(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/agents", nil)
+	if isSPAAuthRequest(req) {
+		t.Fatal("bare request should not be SPA")
+	}
+	req.Header.Set("X-AetherForge-Client", "dashboard")
+	if !isSPAAuthRequest(req) {
+		t.Fatal("client header should mark SPA request")
+	}
+	req = httptest.NewRequest(http.MethodGet, "/api/v1/agents", nil)
+	req.Header.Set("Authorization", "Basic dXNlcjpwYXNz")
+	if !isSPAAuthRequest(req) {
+		t.Fatal("Authorization header should mark SPA request")
+	}
+}
+
+func TestBasicAuthMiddlewareSPANoWWWAuthenticate(t *testing.T) {
+	resetAuthState(t)
+	usersMu.Lock()
+	authUsers["admin"] = "secret"
+	usersMu.Unlock()
+
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("handler should not run without auth")
+	}))
+
+	for _, setup := range []func(*http.Request){
+		func(r *http.Request) { r.Header.Set("X-AetherForge-Client", "dashboard") },
+		func(r *http.Request) { r.Header.Set("Authorization", "Basic dXNlcjpwYXNz") },
+	} {
+		req := httptest.NewRequest(http.MethodGet, "/api/v1/agents", nil)
+		setup(req)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("expected 401, got %d", rec.Code)
+		}
+		if rec.Header().Get("WWW-Authenticate") != "" {
+			t.Fatal("SPA-marked 401 must not include WWW-Authenticate")
+		}
+	}
 }
 
 func TestBasicAuthMiddlewareValidCredentials(t *testing.T) {
@@ -242,6 +288,36 @@ func TestRouterPostUsersValidation(t *testing.T) {
 	}
 }
 
+func TestRouterPostUsersConflict(t *testing.T) {
+	router, _, _, _ := newTestRouter(t)
+	body, _ := json.Marshal(map[string]string{"username": testAuthUser, "password": "otherpass"})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/users", bytes.NewReader(body))
+	req.SetBasicAuth(testAuthUser, testAuthPass)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("existing username should 409, got %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestRouterPostWSTicket(t *testing.T) {
+	router, _, _, _ := newTestRouter(t)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/ws-ticket", nil)
+	req.SetBasicAuth(testAuthUser, testAuthPass)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["ticket"] == nil || body["ticket"] == "" {
+		t.Fatalf("expected ticket in response: %v", body)
+	}
+}
+
 func TestRouterPostUsersSuccess(t *testing.T) {
 	router, _, _, dataDir := newTestRouter(t)
 
@@ -352,7 +428,7 @@ func TestRouterBuildDownloadAuth(t *testing.T) {
 	fleetHandler := NewFleetHandler(database, wsHub, aiHandler, nil, nil, pool.Config{}, dataDir)
 	builderHandler := builder.NewHandler(database, dataDir, "", dataDir)
 	blueprintHandler := NewBlueprintHandler(dataDir)
-	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, NewDropperHandler(database, nil), nil, nil, "", dataDir, nil)
+	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, NewDropperHandler(database, dataDir, nil), nil, nil, "", dataDir, nil, 8989)
 
 	dlURL := "/api/v1/builds/" + buildID + "/download"
 
@@ -429,7 +505,7 @@ func TestRouterNoWebRootFallback(t *testing.T) {
 	builderHandler := builder.NewHandler(database, dataDir, "", dataDir)
 	blueprintHandler := NewBlueprintHandler(dataDir)
 
-	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, nil, nil, nil, "", dataDir, nil)
+	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, nil, nil, nil, "", dataDir, nil, 8989)
 
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	rec := httptest.NewRecorder()