Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/config.go

@@ -183,12 +183,16 @@ func LoadConfig() *Config {
 	cfg.Port = *port
 	cfg.DataDir = *dataDir
 
-  // Try to load from config file
+	// Try to load from config file
 	configPath := filepath.Join(cfg.DataDir, "config.json")
 	if data, err := os.ReadFile(configPath); err == nil {
 		var fileCfg Config
 		if err := json.Unmarshal(data, &fileCfg); err == nil {
-			mergeConfig(cfg, &fileCfg)
+			// Use mergeConfigExplicit so that boolean fields absent from the file
+			// keep their DefaultConfig values instead of being zeroed (H14).
+			var presentKeys map[string]json.RawMessage
+			_ = json.Unmarshal(data, &presentKeys)
+			mergeConfigExplicit(cfg, &fileCfg, presentKeys)
 			if !strings.Contains(string(data), `"open_firewall_on_start"`) {
 				cfg.Server.OpenFirewallOnStart = true
 			}