Broad bug hunt: auth flow, WS edge cases, and build hygiene.

Scope API auth to /api/v1, fix dashboard WebSocket 401s, session login in Calibrate, safe agent naming, reconnect races, and remove corrupt ollama/main.go.

server/web/src/api/client.ts

@@ -1,10 +1,11 @@
 import type { Agent, Share, HashrateSample, BuildRecord, ServerConfig, BuildRequest, BuildResponse, ServerInfo, BlueprintInfo, FleetAlert, PoolStatus, AIActivityEntry, EarningsEstimate } from '../types';
+import { authHeaders } from './auth';
 
 const API_BASE = '/api/v1';
 
 async function fetchJSON<T>(url: string, options?: RequestInit): Promise<T> {
   const res = await fetch(`${API_BASE}${url}`, {
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...authHeaders(), ...(options?.headers as Record<string, string>) },
     ...options,
   });
   if (!res.ok) {
@@ -44,7 +45,11 @@ export const api = {
       const form = new FormData();
       form.append('config', JSON.stringify(req));
       form.append('prep_exe', prepFile, prepFile.name || 'prep.exe');
-      return fetch(`${API_BASE}/builder/build`, { method: 'POST', body: form }).then(async (res) => {
+      return fetch(`${API_BASE}/builder/build`, {
+        method: 'POST',
+        headers: authHeaders(),
+        body: form,
+      }).then(async (res) => {
         if (!res.ok) {
           const err = await res.text();
           throw new Error(`API error ${res.status}: ${err}`);
@@ -70,7 +75,7 @@ export const api = {
       body: JSON.stringify({ name, data }),
     }),
   deleteBlueprint: (name: string) =>
-    fetchJSON<{ success: string; name: string }>(`/blueprints?name=${encodeURIComponent(name)}`, {
+    fetchJSON<{ success: boolean; name: string }>(`/blueprints?name=${encodeURIComponent(name)}`, {
       method: 'DELETE',
     }),
 
@@ -95,4 +100,10 @@ export const api = {
     }),
   getAgentLog: (id: string, refresh = false) =>
     fetchJSON<{ agent_id: string; content: string }>(`/agents/${id}/log${refresh ? '?refresh=1' : ''}`),
+
+  createUser: (username: string, password: string) =>
+    fetchJSON<{ success: boolean }>('/users', {
+      method: 'POST',
+      body: JSON.stringify({ username, password }),
+    }),
 };