fix: second-wave bug fixes, security hardening, visual polish, UX improvements

Bug fixes:
- SRV-B1 through B5: server config, router, server_info, syscheck corrections
- BA-03 through BA-06: builder path and universal build cleanup (BLD-D1 through D3)
- Frontend WS race condition and useVisibleInterval hook fixed
- Drive-root path bug in PathForge resolved
- Upload error handling improved

Security:
- PathForge path traversal guard added
- Script injection escaping applied throughout

Visual (DV-01 through DV-15):
- Cyan design tokens and page headers standardised
- Dead CSS removed from Pages.css, PathTracerPage.css, wealth-deck.css
- SacredPageHeader deleted (replaced inline); sidebar version display fixed

UX:
- Emberwake request storm fixed (EmberwakePage.tsx)
- Help blurbs UH-01, UH-02, UH-06 added
- HelpTips wired into Crucible, Fleet (FleetGroupsStrip, FleetToolbar), Settings

Build:
- vite.config.ts: webroot auto-sync on build
- build_universal.go: universal build artifact cleanup
- PROBLEMS.md tracking updated

server/web/src/pages/SettingsPage.tsx

@@ -838,7 +838,7 @@ export default function SettingsPage() {
         </NeonCard>
 
         <NeonCard accent="amber" className="settings-section operator-deck-card operator-interactive">
-          <h2 className="font-display">Fleet Alerts</h2>
+          <h2 className="font-display">Fleet Alerts <HelpTip field="set_alerts" /></h2>
           <p className="section-desc">Dashboard thresholds for agent health.</p>
           <div className="form-group">
             <label htmlFor="cfg-alert-offline" className="label">Offline After (minutes)</label>
@@ -860,7 +860,7 @@ export default function SettingsPage() {
         </NeonCard>
 
         <NeonCard accent="amber" className="settings-section operator-deck-card operator-interactive">
-          <h2 className="font-display">Alert Notifications</h2>
+          <h2 className="font-display">Alert Notifications <HelpTip field="set_alert_notifications" /></h2>
           <p className="section-desc">
             Telegram, optional webhook, and email for fleet events (operator pub/sub — MITRE T1071.005 lite).
             Set bot token + chat ID or webhook URL, choose what to send, then save.
@@ -877,7 +877,7 @@ export default function SettingsPage() {
                 onChange={(e) => updateField('alerts.telegram_chat_id', e.target.value)} placeholder="123456789" />
             </div>
             <div className="form-group" style={{ gridColumn: '1 / -1' }}>
-              <label htmlFor="cfg-webhook" className="label">Webhook URL (optional)</label>
+              <label htmlFor="cfg-webhook" className="label">Webhook URL (optional) <HelpTip field="set_webhook" /></label>
               <input id="cfg-webhook" type="url" className="input mono" value={config.alerts.webhook_url || ''}
                 onChange={(e) => updateField('alerts.webhook_url', e.target.value)} placeholder="https://hooks.example.com/fleet" />
               <p className="field-hint">JSON POST: event, title, message — on connect, offline, and other enabled alerts.</p>