fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/web/src/api/auth.ts

@@ -1,30 +1,105 @@
 const AUTH_KEY = 'aetherforge_auth';
+const AUTH_EXPIRED_KEY = 'aetherforge_auth_expired';
 
-export function getStoredAuth(): string | null {
+export const AETHERFORGE_CLIENT_HEADER = 'X-AetherForge-Client';
+export const AETHERFORGE_CLIENT_VALUE = 'dashboard';
+
+/** UTF-8-safe Basic auth token (username:password) for Authorization header. */
+export function encodeBasicToken(username: string, password: string): string {
+  const bytes = new TextEncoder().encode(`${username}:${password}`);
+  let binary = '';
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+
+function readAuthStorage(): string | null {
   try {
-    return sessionStorage.getItem(AUTH_KEY);
+    const session = sessionStorage.getItem(AUTH_KEY);
+    if (session) return session;
+  } catch {
+    /* sessionStorage blocked */
+  }
+  try {
+    return localStorage.getItem(AUTH_KEY);
   } catch {
     return null;
   }
 }
 
+function writeAuthStorage(token: string) {
+  try {
+    sessionStorage.setItem(AUTH_KEY, token);
+  } catch {
+    /* ignore */
+  }
+  try {
+    localStorage.setItem(AUTH_KEY, token);
+  } catch {
+    /* ignore */
+  }
+}
+
+function removeAuthStorage() {
+  try {
+    sessionStorage.removeItem(AUTH_KEY);
+  } catch {
+    /* ignore */
+  }
+  try {
+    localStorage.removeItem(AUTH_KEY);
+  } catch {
+    /* ignore */
+  }
+}
+
+export function getStoredAuth(): string | null {
+  return readAuthStorage();
+}
+
 export function setStoredAuth(username: string, password: string, opts?: { silent?: boolean }) {
-  const token = btoa(`${username}:${password}`);
-  sessionStorage.setItem(AUTH_KEY, token);
+  const token = encodeBasicToken(username, password);
+  writeAuthStorage(token);
   if (!opts?.silent) {
     window.dispatchEvent(new Event('aetherforge-auth'));
   }
 }
 
-export function clearStoredAuth(opts?: { silent?: boolean }) {
-  sessionStorage.removeItem(AUTH_KEY);
+export function clearStoredAuth(opts?: { silent?: boolean; expired?: boolean }) {
+  if (opts?.expired) {
+    try {
+      sessionStorage.setItem(AUTH_EXPIRED_KEY, '1');
+    } catch {
+      /* ignore */
+    }
+  }
+  removeAuthStorage();
   if (!opts?.silent) {
     window.dispatchEvent(new Event('aetherforge-auth'));
   }
 }
 
+/** True once after a 401 cleared stored credentials; consumed by SessionGate login UI. */
+export function consumeAuthExpiredFlag(): boolean {
+  try {
+    if (sessionStorage.getItem(AUTH_EXPIRED_KEY)) {
+      sessionStorage.removeItem(AUTH_EXPIRED_KEY);
+      return true;
+    }
+  } catch {
+    /* ignore */
+  }
+  return false;
+}
+
 export function authHeaders(): Record<string, string> {
+  const headers: Record<string, string> = {
+    [AETHERFORGE_CLIENT_HEADER]: AETHERFORGE_CLIENT_VALUE,
+  };
   const token = getStoredAuth();
-  if (!token) return {};
-  return { Authorization: `Basic ${token}` };
+  if (token) {
+    headers.Authorization = `Basic ${token}`;
+  }
+  return headers;
 }