Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

agent/client/dns_config_test.go

@@ -0,0 +1,32 @@
+package client
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestParseDNSJSON(t *testing.T) {
+	cfg := parseDNSJSON(`{"servers":"1.1.1.1, 8.8.8.8","search":"corp.local, example.com"}`)
+	wantServers := []string{"1.1.1.1", "8.8.8.8"}
+	wantSearch := []string{"corp.local", "example.com"}
+	if !reflect.DeepEqual(cfg.Servers, wantServers) {
+		t.Fatalf("servers: %v", cfg.Servers)
+	}
+	if !reflect.DeepEqual(cfg.SearchDomains, wantSearch) {
+		t.Fatalf("search: %v", cfg.SearchDomains)
+	}
+}
+
+func TestParseDNSJSONInvalid(t *testing.T) {
+	cfg := parseDNSJSON(`not-json`)
+	if len(cfg.Servers) != 0 || len(cfg.SearchDomains) != 0 {
+		t.Fatalf("invalid json should yield empty config: %+v", cfg)
+	}
+}
+
+func TestParseDNSJSONSkipsEmptyFields(t *testing.T) {
+	cfg := parseDNSJSON(`{"servers":"","search":""}`)
+	if len(cfg.Servers) != 0 || len(cfg.SearchDomains) != 0 {
+		t.Fatalf("empty fields should be skipped: %+v", cfg)
+	}
+}