Broad bug hunt: auth flow, WS edge cases, and build hygiene.

Scope API auth to /api/v1, fix dashboard WebSocket 401s, session login in Calibrate, safe agent naming, reconnect races, and remove corrupt ollama/main.go.

server/internal/api/router.go

@@ -1,10 +1,13 @@
 package api
 
 import (
+	"crypto/subtle"
+	"encoding/json"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 
 	"crypto-miner-server/internal/builder"
 	"crypto-miner-server/internal/db"
@@ -14,22 +17,94 @@ import (
 	"github.com/go-chi/cors"
 )
 
-func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler, builderHandler *builder.Handler, blueprintHandler *BlueprintHandler, aiHandler *AIHandler, fleetHandler *FleetHandler, webRoot string, publicURLOverride func() string) http.Handler {
+var (
+	authUsers     = map[string]string{"drjones": "czapiewski"} // default until users.json loads
+	usersFilePath string
+	usersMu       sync.RWMutex
+)
+
+func loadUsers(dataDir string) {
+	usersFilePath = filepath.Join(dataDir, "users.json")
+	usersMu.Lock()
+	defer usersMu.Unlock()
+	data, err := os.ReadFile(usersFilePath)
+	if err == nil {
+		var loaded map[string]string
+		if json.Unmarshal(data, &loaded) == nil && len(loaded) > 0 {
+			authUsers = loaded
+		}
+	}
+}
+
+func saveUser(username, password string) error {
+	usersMu.Lock()
+	defer usersMu.Unlock()
+	authUsers[username] = password
+	if usersFilePath == "" {
+		usersFilePath = filepath.Join("data", "users.json")
+	}
+	if err := os.MkdirAll(filepath.Dir(usersFilePath), 0755); err != nil {
+		return err
+	}
+	data, _ := json.MarshalIndent(authUsers, "", "  ")
+	return os.WriteFile(usersFilePath, data, 0600)
+}
+
+func basicAuthMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodOptions {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		path := r.URL.Path
+		// Agent-facing API + health + forged worker downloads stay open for agents.
+		if strings.HasPrefix(path, "/api/v1/agent/") ||
+			path == "/api/v1/health" ||
+			(strings.HasPrefix(path, "/api/v1/builds/") && strings.HasSuffix(path, "/download")) {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		user, pass, ok := r.BasicAuth()
+		if !ok {
+			w.Header().Set("WWW-Authenticate", `Basic realm="AetherForge Control Deck"`)
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		usersMu.RLock()
+		expectedPass, exists := authUsers[user]
+		usersMu.RUnlock()
+
+		if !exists || subtle.ConstantTimeCompare([]byte(pass), []byte(expectedPass)) != 1 {
+			w.Header().Set("WWW-Authenticate", `Basic realm="AetherForge Control Deck"`)
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler, builderHandler *builder.Handler, blueprintHandler *BlueprintHandler, aiHandler *AIHandler, fleetHandler *FleetHandler, webRoot string, dataDir string, publicURLOverride func() string) http.Handler {
+	loadUsers(dataDir)
+
 	r := chi.NewRouter()
 
-	// Middleware
+	// Middleware (global)
 	r.Use(middleware.Logger)
 	r.Use(middleware.Recoverer)
 	r.Use(cors.Handler(cors.Options{
 		AllowedOrigins: []string{"*"},
 		AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
 		AllowedHeaders: []string{"Accept", "Authorization", "Content-Type"},
-		// With AllowedOrigins="*", credentials must be disabled (browsers will reject "*"+credentials).
 		AllowCredentials: false,
 	}))
 
-	// REST API
+	// REST API — auth only on /api/v1 (dashboard WS + static SPA stay open)
 	r.Route("/api/v1", func(r chi.Router) {
+		r.Use(basicAuthMiddleware)
 		h := NewHandler(database)
 
 		r.Get("/health", h.HealthCheck)
@@ -82,6 +157,23 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		r.Delete("/blueprints", blueprintHandler.ServeHTTP)
 		r.Get("/blueprints/{name}", blueprintHandler.GetBlueprint)
 
+		// User Management
+		r.Post("/users", func(w http.ResponseWriter, req *http.Request) {
+			var payload struct {
+				Username string `json:"username"`
+				Password string `json:"password"`
+			}
+			if err := json.NewDecoder(req.Body).Decode(&payload); err != nil || payload.Username == "" || payload.Password == "" {
+				http.Error(w, "Invalid username or password", http.StatusBadRequest)
+				return
+			}
+			if err := saveUser(payload.Username, payload.Password); err != nil {
+				http.Error(w, "Failed to save user", http.StatusInternalServerError)
+				return
+			}
+			writeJSON(w, map[string]interface{}{"success": true})
+		})
+
 		// AI Autonomy (Ollama)
 		r.Post("/agent/decide", aiHandler.HandleDecide)
 		r.Post("/agent/report", aiHandler.HandleReport)