Broad bug hunt: auth flow, WS edge cases, and build hygiene.

Scope API auth to /api/v1, fix dashboard WebSocket 401s, session login in Calibrate, safe agent naming, reconnect races, and remove corrupt ollama/main.go.

server/internal/api/websocket_auth_test.go

@@ -32,3 +32,22 @@ func TestAuthPayloadWorkerNameFallback(t *testing.T) {
 		t.Fatalf("expected forged worker name, got %q", displayName)
 	}
 }
+
+func TestShortAgentID(t *testing.T) {
+	if shortAgentID("abcdef12-3456") != "abcdef12" {
+		t.Fatalf("expected 8-char prefix")
+	}
+	if shortAgentID("ab") != "ab" {
+		t.Fatalf("expected short id preserved")
+	}
+	if shortAgentID("") != "agent" {
+		t.Fatalf("expected fallback agent label")
+	}
+}
+
+func TestAgentDisplayNameFallback(t *testing.T) {
+	name := agentDisplayName("", "", "", "12345678-abcd")
+	if name != "12345678" {
+		t.Fatalf("expected id prefix, got %q", name)
+	}
+}