fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/web/src/help/forgeCompatibility.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { runForgeCompatibilityChecks } from './forgeCompatibility';
+import { runForgePreflight } from './forgeValidation';
 import { FORGE_BUILD_DEFAULTS } from './forgeDefaults';
 import type { BuildRequest } from '../types';
 
@@ -177,35 +178,37 @@ describe('runForgeCompatibilityChecks', () => {
       expect(hasCheck(baseForm({ process_name: 'bad name!' }), false, 'process_name', 'warn')).toBe(true);
     });
 
-    it('errors when worker name is empty', () => {
-      expect(hasCheck(baseForm({ worker_name: '' }), false, 'worker_name_empty', 'error')).toBe(true);
+    it('errors when worker name is empty (preflight)', () => {
+      const checks = runForgePreflight(baseForm({ worker_name: '' }), false);
+      expect(checks.find((c) => c.id === 'worker')?.level).toBe('error');
     });
 
-    it('errors when server URL uses localhost', () => {
-      expect(
-        hasCheck(baseForm({ server_url: 'http://localhost:8989' }), false, 'server_url_localhost', 'error')
-      ).toBe(true);
+    it('errors when server URL uses localhost (preflight)', () => {
+      const checks = runForgePreflight(baseForm({ server_url: 'http://localhost:8989' }), false);
+      expect(checks.find((c) => c.id === 'server')?.level).toBe('error');
     });
 
-    it('errors when server URL uses 127.0.0.1', () => {
-      expect(
-        hasCheck(baseForm({ server_url: 'http://127.0.0.1:8989' }), false, 'server_url_localhost', 'error')
-      ).toBe(true);
+    it('errors when server URL uses 127.0.0.1 (preflight)', () => {
+      const checks = runForgePreflight(baseForm({ server_url: 'http://127.0.0.1:8989' }), false);
+      expect(checks.find((c) => c.id === 'server')?.level).toBe('error');
     });
 
-    it('warns when wallet does not match Monero format', () => {
-      expect(hasCheck(baseForm({ wallet: 'not-a-wallet' }), false, 'wallet_invalid', 'warn')).toBe(true);
+    it('warns when wallet does not match Monero format (preflight)', () => {
+      const checks = runForgePreflight(baseForm({ wallet: 'not-a-wallet' }), false);
+      expect(checks.find((c) => c.id === 'wallet')?.level).toBe('warn');
     });
 
-    it('accepts minimum-length wallet (90 chars)', () => {
+    it('accepts minimum-length wallet (90 chars) in preflight', () => {
       const wallet = '4' + 'A'.repeat(89);
       expect(wallet.length).toBe(90);
-      expect(hasCheck(baseForm({ wallet }), false, 'wallet_invalid')).toBe(false);
+      const checks = runForgePreflight(baseForm({ wallet }), false);
+      expect(checks.find((c) => c.id === 'wallet')?.level).toBe('ok');
     });
 
-    it('accepts subaddress starting with 8', () => {
+    it('accepts subaddress starting with 8 in preflight', () => {
       const subaddress = '8' + 'B'.repeat(94);
-      expect(hasCheck(baseForm({ wallet: subaddress }), false, 'wallet_invalid')).toBe(false);
+      const checks = runForgePreflight(baseForm({ wallet: subaddress }), false);
+      expect(checks.find((c) => c.id === 'wallet')?.level).toBe('ok');
     });
 
     it('emits forge_ready when core config is coherent', () => {