Broad bug hunt: auth flow, WS edge cases, and build hygiene.

Scope API auth to /api/v1, fix dashboard WebSocket 401s, session login in Calibrate, safe agent naming, reconnect races, and remove corrupt ollama/main.go.

server/internal/api/fleet_handler.go

@@ -86,6 +86,10 @@ type agentCommandRequest struct {
 
 func (f *FleetHandler) PostAgentCommand(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
+	if id == "" {
+		http.Error(w, "agent id is required", http.StatusBadRequest)
+		return
+	}
 	var req agentCommandRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		http.Error(w, "invalid command", http.StatusBadRequest)