fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/limits_test.go

@@ -1,6 +1,37 @@
 package builder
 
-import "testing"
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCheckBuildSizeEnforced(t *testing.T) {
+	h := &Handler{policy: BuildPolicy{MaxBuildSizeMB: 1}}
+	if err := h.checkBuildSize(2 * 1024 * 1024); err == nil {
+		t.Fatal("expected oversize error")
+	}
+	if err := h.checkBuildSize(512 * 1024); err != nil {
+		t.Fatalf("expected within limit: %v", err)
+	}
+}
+
+func TestCheckBuildSizeFile(t *testing.T) {
+	h := &Handler{policy: BuildPolicy{MaxBuildSizeMB: 1}}
+	path := filepath.Join(t.TempDir(), "big.zip")
+	if err := os.WriteFile(path, make([]byte, 2*1024*1024), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.checkBuildSizeFile(path); err == nil {
+		t.Fatal("expected file size check failure")
+	}
+}
+
+func TestMultipartMaxMemoryCoversFusionUpload(t *testing.T) {
+	if multipartMaxMemory <= FusionMaxUploadBytes {
+		t.Fatalf("multipartMaxMemory %d must exceed FusionMaxUploadBytes %d", multipartMaxMemory, FusionMaxUploadBytes)
+	}
+}
 
 func TestFusionConstants(t *testing.T) {
 	if FusionMaxUploadBytes != 2<<30 {