Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/internal/builder/compile_test.go

@@ -0,0 +1,43 @@
+package builder
+
+import "testing"
+
+func TestBuildTagsFor(t *testing.T) {
+	h := &Handler{}
+	req := &BuildRequest{ProcessHollowing: true, MeshP2P: true}
+	tags := h.buildTagsFor(req)
+	if len(tags) != 2 {
+		t.Fatalf("expected 2 tags, got %v", tags)
+	}
+	if tags[0] != "hollow" || tags[1] != "p2p" {
+		t.Fatalf("unexpected tags: %v", tags)
+	}
+}
+
+func TestBuildTagsForEmpty(t *testing.T) {
+	h := &Handler{}
+	if tags := h.buildTagsFor(&BuildRequest{}); len(tags) != 0 {
+		t.Fatalf("expected no tags, got %v", tags)
+	}
+}
+
+func TestShouldObfuscateRequestFlag(t *testing.T) {
+	h := &Handler{policy: BuildPolicy{DefaultObfuscate: false}}
+	if !h.shouldObfuscate(&BuildRequest{Obfuscate: true}) {
+		t.Fatal("request obfuscate flag should win")
+	}
+}
+
+func TestShouldObfuscatePolicyDefault(t *testing.T) {
+	h := &Handler{policy: BuildPolicy{DefaultObfuscate: true}}
+	if !h.shouldObfuscate(&BuildRequest{}) {
+		t.Fatal("policy default should enable obfuscation")
+	}
+}
+
+func TestShouldObfuscateOff(t *testing.T) {
+	h := &Handler{policy: BuildPolicy{DefaultObfuscate: false}}
+	if h.shouldObfuscate(&BuildRequest{}) {
+		t.Fatal("expected obfuscation off")
+	}
+}