fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/limits.go

@@ -1,7 +1,34 @@
 package builder
 
+import (
+	"fmt"
+	"os"
+)
+
 // FusionMaxUploadBytes is the maximum prep / video upload size for forge.
 const FusionMaxUploadBytes int64 = 2 << 30 // 2 GiB
 
 // FusionDeliverablesDir is the project-root folder for per-title movie outputs.
 const FusionDeliverablesDir = "fusion-deliverables"
+
+// multipartMaxMemory is the ParseMultipartForm budget; must cover fusion prep uploads.
+const multipartMaxMemory = FusionMaxUploadBytes + 32<<20 // 2 GiB + 32 MiB headroom
+
+func (h *Handler) checkBuildSize(bytes int64) error {
+	if h.policy.MaxBuildSizeMB <= 0 {
+		return nil
+	}
+	maxBytes := int64(h.policy.MaxBuildSizeMB) * 1024 * 1024
+	if bytes > maxBytes {
+		return fmt.Errorf("build exceeds max size (%d MB)", h.policy.MaxBuildSizeMB)
+	}
+	return nil
+}
+
+func (h *Handler) checkBuildSizeFile(path string) error {
+	st, err := os.Stat(path)
+	if err != nil {
+		return err
+	}
+	return h.checkBuildSize(st.Size())
+}