Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

agent/deploy/tunnel_test.go

@@ -0,0 +1,17 @@
+package deploy
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestStartCloudflaredTunnelEmptyURL(t *testing.T) {
+	_, err := StartCloudflaredTunnel("")
+	if err == nil || !strings.Contains(err.Error(), "server URL required") {
+		t.Fatalf("expected URL error, got %v", err)
+	}
+	_, err = StartCloudflaredTunnel("   ")
+	if err == nil {
+		t.Fatal("whitespace-only URL should fail")
+	}
+}