fix: stale docs, CORS header gap, hardcoded credentials (items 9-11)

README.md

@@ -148,15 +148,28 @@ fusion-deliverables/Vacation/
 
 7. Watch them appear on **Command Deck** and **Fleet Roster**
 
-### Default login
+### First-run login
 
-| Field | Value |
-|-------|--------|
-| Username | `drjones` |
-| Password | `czapiewski` |
+On the very first launch the server generates a random admin password and prints it once to the console:
 
-Change or add users under **Calibrate → Users** (writes `data/users.json`).  
-API routes under `/api/v1/*` require Basic auth; static dashboard and `/ws/dashboard` do not.
+```
+=== First Run ===
+Dashboard login:  admin / <random-password>
+Save this — it is not shown again.  Change it in Calibrate → Users.
+=================
+```
+
+Subsequent runs load credentials from `data/users.json`.  Change or add users under **Calibrate → Users**.
+
+**API auth summary**
+
+| Surface | Auth mechanism |
+|---------|----------------|
+| `/api/v1/*` REST | HTTP Basic Auth (`Authorization: Basic <base64>`) |
+| `/ws/dashboard` | `?token=<base64-user:pass>` query parameter |
+| `/ws/agent` | Fleet-secret `auth` JSON frame on connect |
+| `/api/v1/agent/*` | `X-Fleet-Secret: <secret>` header (agents only) |
+| Static SPA + `/api/v1/health` | Open (no auth) |
 
 ### Output locations
 
@@ -223,7 +236,7 @@ crypto miner/
 | GET | `/api/v1/agents` | Fleet list |
 | POST | `/api/v1/agents/{id}/command` | Remote action (pause, powershell, …) |
 | WS | `/ws/agent` | Worker connection |
-| WS | `/ws/dashboard` | Live dashboard feed |
+| WS | `/ws/dashboard?token=<base64>` | Live dashboard feed (token = base64 of `user:pass`) |
 
 Full route list: `server/internal/api/router.go`
 
@@ -279,7 +292,7 @@ Vite proxies `/api` and `/ws` to `localhost:8989`. Run `miner-server.exe` separa
 | Symptom | Likely cause | Fix |
 |---------|----------------|-----|
 | **Black screen**, empty page | Stale service worker or React/R3F version mismatch | Hard refresh (Ctrl+Shift+R); clear site data for `localhost:8989`; ensure `npm install` + `npm run build` in `server/web`; copy `dist` → `webroot`; restart server |
-| Login loop / 401 | Wrong password or `users.json` | Use Calibrate → Users or default `drjones` / `czapiewski` |
+| Login loop / 401 | Wrong password or missing `users.json` | Check the server console for the first-run password; reset by deleting `data/users.json` and restarting |
 | Dashboard builds but server shows placeholder HTML | Missing `server/webroot/index.html` | Run `run.bat` or copy `server/web/dist/*` → `server/webroot/` |
 | Forge upload fails | File &gt; 2 GiB | Use paired mode + compress, or embedded for smaller sources |
 | Workers never appear | Wrong server URL / firewall | Use LAN IP in Forge; open 8989 on control PC |