Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/internal/api/fleet_handler.go

@@ -23,11 +23,7 @@ type xmrPriceEntry struct {
 	fetchedAt time.Time
 }
 
-var (
-	xmrPriceMu    sync.Mutex
-	xmrPriceCache *xmrPriceEntry
-	xmrPriceTTL   = 10 * time.Minute
-)
+const xmrPriceTTL = 10 * time.Minute
 
 type FleetHandler struct {
 	db          *db.Database
@@ -37,6 +33,10 @@ type FleetHandler struct {
 	alerts      *alerts.Evaluator
 	defaultPool pool.Config
 
+	// XMR price cache — per-handler so multiple routers in one process stay isolated.
+	xmrPriceMu    sync.Mutex
+	xmrPriceCache *xmrPriceEntry
+
 	// Real-earnings cache (avoids hammering the pool API)
 	earningsMu    sync.Mutex
 	earningsCache map[string]*poolEarningsCache
@@ -87,11 +87,11 @@ func (f *FleetHandler) GetAIActivity(w http.ResponseWriter, r *http.Request) {
 // GetXMRPrice returns the current XMR/USD price from CoinGecko, cached for 10 minutes.
 // Falls back to a 503 when the upstream is unreachable so the frontend can degrade gracefully.
 func (f *FleetHandler) GetXMRPrice(w http.ResponseWriter, r *http.Request) {
-	xmrPriceMu.Lock()
-	if xmrPriceCache != nil && time.Since(xmrPriceCache.fetchedAt) < xmrPriceTTL {
-		usd := xmrPriceCache.USD
-		at := xmrPriceCache.fetchedAt
-		xmrPriceMu.Unlock()
+	f.xmrPriceMu.Lock()
+	if f.xmrPriceCache != nil && time.Since(f.xmrPriceCache.fetchedAt) < xmrPriceTTL {
+		usd := f.xmrPriceCache.USD
+		at := f.xmrPriceCache.fetchedAt
+		f.xmrPriceMu.Unlock()
 		writeJSON(w, map[string]interface{}{
 			"usd":        usd,
 			"fetched_at": at.UTC().Format(time.RFC3339),
@@ -99,7 +99,7 @@ func (f *FleetHandler) GetXMRPrice(w http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
-	xmrPriceMu.Unlock()
+	f.xmrPriceMu.Unlock()
 
 	client := &http.Client{Timeout: 8 * time.Second}
 	resp, err := client.Get("https://api.coingecko.com/api/v3/simple/price?ids=monero&vs_currencies=usd") //nolint:gosec
@@ -118,9 +118,9 @@ func (f *FleetHandler) GetXMRPrice(w http.ResponseWriter, r *http.Request) {
 	usd := raw["monero"]["usd"]
 
 	entry := &xmrPriceEntry{USD: usd, fetchedAt: time.Now()}
-	xmrPriceMu.Lock()
-	xmrPriceCache = entry
-	xmrPriceMu.Unlock()
+	f.xmrPriceMu.Lock()
+	f.xmrPriceCache = entry
+	f.xmrPriceMu.Unlock()
 
 	writeJSON(w, map[string]interface{}{
 		"usd":        usd,