fix: second-wave bug fixes, security hardening, visual polish, UX improvements

Bug fixes:
- SRV-B1 through B5: server config, router, server_info, syscheck corrections
- BA-03 through BA-06: builder path and universal build cleanup (BLD-D1 through D3)
- Frontend WS race condition and useVisibleInterval hook fixed
- Drive-root path bug in PathForge resolved
- Upload error handling improved

Security:
- PathForge path traversal guard added
- Script injection escaping applied throughout

Visual (DV-01 through DV-15):
- Cyan design tokens and page headers standardised
- Dead CSS removed from Pages.css, PathTracerPage.css, wealth-deck.css
- SacredPageHeader deleted (replaced inline); sidebar version display fixed

UX:
- Emberwake request storm fixed (EmberwakePage.tsx)
- Help blurbs UH-01, UH-02, UH-06 added
- HelpTips wired into Crucible, Fleet (FleetGroupsStrip, FleetToolbar), Settings

Build:
- vite.config.ts: webroot auto-sync on build
- build_universal.go: universal build artifact cleanup
- PROBLEMS.md tracking updated

server/internal/api/router.go

@@ -542,7 +542,7 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 			if cloudflaredConfigured != nil {
 				tunnelReady = cloudflaredConfigured()
 			}
-			GetServerInfo(w, r, override, listenPort, tunnelReady)
+			GetServerInfo(w, r, override, listenPort, tunnelReady, version)
 		})
 
 		// Dashboard

server/internal/api/server_info.go

@@ -26,13 +26,14 @@ type ServerInfo struct {
 	SuggestedURL          string   `json:"suggested_url"`
 	DashboardURL          string   `json:"dashboard_url"`
 	WebSocketURL          string   `json:"websocket_url"`
+	Version               string   `json:"version,omitempty"`
 }
 
 // GetServerInfo returns URLs workers and droppers should use to reach this deck.
 // When the dashboard is opened via HTTPS reverse proxy (e.g. Cloudflare tunnel),
 // suggested_url uses https and omits :443 — not the local listen port (8989).
 // lan_url is always the LAN http endpoint for workers on the same network.
-func GetServerInfo(w http.ResponseWriter, r *http.Request, publicURLOverride string, listenPort int, cloudflaredConfigured bool) {
+func GetServerInfo(w http.ResponseWriter, r *http.Request, publicURLOverride string, listenPort int, cloudflaredConfigured bool, version ...string) {
 	if listenPort <= 0 {
 		listenPort = 8989
 	}
@@ -62,6 +63,9 @@ func GetServerInfo(w http.ResponseWriter, r *http.Request, publicURLOverride str
 		DashboardURL:          suggestedURL,
 		WebSocketURL:          httpToWS(suggestedURL) + "/ws/agent",
 	}
+	if len(version) > 0 {
+		info.Version = version[0]
+	}
 
 	writeJSON(w, info)
 }