fix: second-wave bug fixes, security hardening, visual polish, UX improvements

Bug fixes:
- SRV-B1 through B5: server config, router, server_info, syscheck corrections
- BA-03 through BA-06: builder path and universal build cleanup (BLD-D1 through D3)
- Frontend WS race condition and useVisibleInterval hook fixed
- Drive-root path bug in PathForge resolved
- Upload error handling improved

Security:
- PathForge path traversal guard added
- Script injection escaping applied throughout

Visual (DV-01 through DV-15):
- Cyan design tokens and page headers standardised
- Dead CSS removed from Pages.css, PathTracerPage.css, wealth-deck.css
- SacredPageHeader deleted (replaced inline); sidebar version display fixed

UX:
- Emberwake request storm fixed (EmberwakePage.tsx)
- Help blurbs UH-01, UH-02, UH-06 added
- HelpTips wired into Crucible, Fleet (FleetGroupsStrip, FleetToolbar), Settings

Build:
- vite.config.ts: webroot auto-sync on build
- build_universal.go: universal build artifact cleanup
- PROBLEMS.md tracking updated

server/config_test.go

@@ -523,9 +523,14 @@ func TestMergeConfigLegacyScalarsAndBooleans(t *testing.T) {
 	if dst.Server.StatsRetentionHours != 72 {
 		t.Fatalf("stats retention: %d", dst.Server.StatsRetentionHours)
 	}
-	// Known legacy: UseTLS copied from src even when false on zero-value partial src
+	// mergeConfig (legacy) unconditionally copies UseTLS, so a partial src with
+	// UseTLS==false will clear a true value in dst. This is expected for the legacy
+	// function. The API PUT handler uses UpdateConfigFromJSON → mergeConfigExplicit,
+	// which only applies UseTLS when the "use_tls" key is explicitly present in the
+	// JSON payload, so false can be set intentionally and absent means "no change".
+	// No fix needed for partial-PUT; this test documents the legacy-function quirk.
 	if dst.Pool.UseTLS {
-		t.Log("mergeConfig sets UseTLS from src zero value on partial update")
+		t.Fatal("mergeConfig always copies UseTLS from src; zero src must clear TLS")
 	}
 }