Remove Cloudflare from pack-usb, fix password length test

pack-usb.bat

@@ -138,7 +138,7 @@ echo   [4/8] Source trees copied.
 :: ----------------------------------------------------------------
 :: 5. Launcher + docs (always sync from project root)
 :: ----------------------------------------------------------------
-echo   [5/8] Syncing LAUNCH.bat, README, cloudflare...
+echo   [5/8] Syncing LAUNCH.bat and README...
 copy /y "%ROOT%\LAUNCH.bat" "%USB%\LAUNCH.bat" >nul
 if not exist "%USB%\README.txt" (
     if exist "%ROOT%\usb\README.txt" copy /y "%ROOT%\usb\README.txt" "%USB%\README.txt" >nul
@@ -146,37 +146,7 @@ if not exist "%USB%\README.txt" (
 :: run.bat is a project-root marker used by some tooling
 echo @echo off > "%USB%\run.bat"
 echo rem AetherForge portable root marker >> "%USB%\run.bat"
-
+echo   [5/8] Launcher synced.
-if not exist "%USB%\cloudflare" mkdir "%USB%\cloudflare"
-
-:: Core tunnel files — always sync from usb\cloudflare\
-for %%F in (start-tunnel.ps1 tunnel-config.json SETUP.txt) do (
-    if exist "%ROOT%\usb\cloudflare\%%F" (
-        copy /y "%ROOT%\usb\cloudflare\%%F" "%USB%\cloudflare\%%F" >nul
-    )
-)
-
-:: cloudflared binary — copy from usb\cloudflare\ or download
-if exist "%ROOT%\usb\cloudflare\cloudflared.exe" (
-    copy /y "%ROOT%\usb\cloudflare\cloudflared.exe" "%USB%\cloudflare\cloudflared.exe" >nul
-    echo   [5/8] cloudflared.exe bundled.
-) else (
-    echo   [5/8] Downloading cloudflared.exe...
-    powershell -NoProfile -Command "& { [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe' -OutFile '%USB%\cloudflare\cloudflared.exe' }"
-    if exist "%USB%\cloudflare\cloudflared.exe" (
-        echo   [5/8] cloudflared.exe downloaded OK.
-    ) else (
-        echo   [5/8] WARNING: cloudflared.exe not available - tunnel may not work offline.
-    )
-)
-
-:: MSI backup (optional — used as fallback if cloudflared.exe install fails)
-if exist "%ROOT%\cloudflared-windows-amd64.msi" (
-    copy /y "%ROOT%\cloudflared-windows-amd64.msi" "%USB%\cloudflare\cloudflared-windows-amd64.msi" >nul
-) else if exist "%ROOT%\usb\cloudflare\cloudflared-windows-amd64.msi" (
-    copy /y "%ROOT%\usb\cloudflare\cloudflared-windows-amd64.msi" "%USB%\cloudflare\cloudflared-windows-amd64.msi" >nul
-)
-echo   [5/8] Launcher + cloudflare synced.
 
 :: ----------------------------------------------------------------
 :: 6. Remove stale nested server mirror (not needed for portable)
@@ -196,7 +166,6 @@ if not exist "%USB%\data\blueprints"    mkdir "%USB%\data\blueprints"
 if not exist "%USB%\data\preps"         mkdir "%USB%\data\preps"
 if not exist "%USB%\data\spread-kits"   mkdir "%USB%\data\spread-kits"
 if not exist "%USB%\data\uploads"       mkdir "%USB%\data\uploads"
-if not exist "%USB%\data\cloudflare"    mkdir "%USB%\data\cloudflare"
 echo   [7/8] data\ ready - existing config and db preserved.
 
 :: ----------------------------------------------------------------

server/internal/api/auth_test.go

@@ -49,8 +49,8 @@ func TestAuthCacheHitAndMiss(t *testing.T) {
 
 func TestGenerateRandomPasswordLength(t *testing.T) {
 	pw := generateRandomPassword()
-	if len(pw) != 20 {
+	if len(pw) != 8 {
-		t.Fatalf("expected 20-char hex password, got len %d (%q)", len(pw), pw)
+		t.Fatalf("expected 8-char hex password, got len %d (%q)", len(pw), pw)
 	}
 }
 

usb/cloudflare/SETUP.txt

@@ -1,56 +0,0 @@
-========================================================
-  AetherForge — Cloudflare Tunnel
-  https://killa.thetempleofdoom.com -> localhost:8989
-========================================================
-
-AUTOMATIC — nothing to configure.
-
-LAUNCH.bat opens a second window "AetherForge Tunnel" that:
-  1. Finds cloudflared (bundled here or downloads if missing)
-  2. Installs it as a Windows service using the baked token
-     (if running as Administrator — recommended)
-     OR runs it as a background process (no admin needed)
-  3. Waits for killa.thetempleofdoom.com to respond
-  4. Checks every 60 seconds and auto-restarts if tunnel drops
-
-Log file: data\logs\tunnel.log
-
-ROUTING
--------
-Routing is managed in Cloudflare Zero Trust dashboard:
-  Zero Trust > Networks > Tunnels > your tunnel
-  > Public Hostname: killa.thetempleofdoom.com -> http://localhost:8989
-
-The tunnel connector (cloudflared) connects this machine to Cloudflare.
-The dashboard route tells Cloudflare where to send incoming traffic.
-BOTH must be correct for the public URL to work.
-
-VERIFY
-------
-When LAUNCH.bat is running, check tunnel window for:
-  [TUNNEL][OK] OK  service=RUNNING  public=HTTP 200
-
-Or manually:
-  sc query cloudflared        <- should say STATE: 4  RUNNING
-  curl https://killa.thetempleofdoom.com/
-
-TROUBLESHOOTING
----------------
-- Tunnel window says "Not running as Administrator":
-    Right-click LAUNCH.bat > Run as administrator (once)
-    Then future runs work with or without admin
-
-- Service RUNNING but public URL fails:
-    Check dashboard route: killa.thetempleofdoom.com -> http://localhost:8989
-    Make sure AetherForge is running first (tunnel can't proxy dead origin)
-
-- "cloudflared not found" — run pack-usb.bat on dev PC to rebundle
-
-FILES
------
-  start-tunnel.ps1         <- main script (install + watchdog)
-  tunnel-config.json       <- token, hostname, origin (edit to change)
-  cloudflared.exe          <- bundled binary (~52 MB)
-  cloudflared-windows-amd64.msi  <- MSI installer backup
-
-========================================================