Fix Vitest suite and wire cloud/AWS dashboard API helpers.

Adds missing client methods, VPC seeder badges, hospice strain UI, and uiHelp drift keys so server/web builds and all 849 Vitest tests pass.

PROBLEMS.md

@@ -4,7 +4,7 @@ Open issues only. Fixed items removed. Last sweep: 2026-06-07.
 
 ## No open code issues
 
-Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **912**, agent **644**, Vitest **835**, Playwright **26** — see `tests/README.md`.
+Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **939**, agent **655**, Vitest **847**, Playwright **26** — see `tests/README.md`.
 
 ## By design / safety
 
@@ -81,8 +81,14 @@ Automatable gaps are closed; remaining items below are by-design limits, archite
 
 | Item | Notes |
 |------|-------|
-
-
+| **Live S3 PutObject + CloudFront signed magnets** | CI mocks `AttachS3Swarm` inject store; operator `AF_AWS_*` / `AF_CLOUDFRONT_*` + bucket policy required for real shard upload. |
+| **SSM SendCommand on owned EC2** | Emberwake exports document + run-command CLI only; server never calls AWS SSM APIs. |
+| **Fargate ECS RunTask burst** | Task-definition ZIP + campaign sync tested; operator applies ECS/Fargate in their VPC. |
+| **EventBridge policy fan-out Lambda** | Fan-out ZIP + public snapshot URL tested; relay Lambda/EventBridge is operator-deployed. |
+| **Cloud Map route_via on deploy plans** | Agent registry fetch tested; server `AttachCloudMapRouteVia` wiring deferred (skipped Go tests). |
+| **Cloud venue on live EC2** | IMDS tag inference tested with inject; real `g4dn`/spot/batch labels need AWS instances. |
+| **Onion contingency LLM invoke** | Deterministic persona branch compose in CI; live court LLM on every exhaust tick not automated. |
+| **P2 spread lanes (manual only)** | Live Docker/Podman start; real WinRM/GPO/systemd/crontab on remote hosts; live BITS/curl; live multi-hop discover→spread without Playwright stub. |
 ## Do not commit
 
 - `data/login-credentials.json`, `data/users.json`, and other local secrets.