Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/internal/builder/media_lock_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -77,6 +78,42 @@ func TestEncryptMediaRoundTrip(t *testing.T) {
 	if string(got) != string(plain) {
 		t.Fatalf("roundtrip mismatch")
 	}
-	_ = base64.StdEncoding.EncodeToString(key) // key format used in manifest
+	b64 := MediaLockKeyB64(key)
+	if b64 != base64.StdEncoding.EncodeToString(key) {
+		t.Fatalf("MediaLockKeyB64 mismatch: %q", b64)
+	}
+}
+
+func TestEncryptMediaFileEmptyKey(t *testing.T) {
+	dir := t.TempDir()
+	src := filepath.Join(dir, "x.bin")
+	if err := os.WriteFile(src, []byte("x"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	err := EncryptMediaFile(src, filepath.Join(dir, "out.bin"), nil)
+	if err == nil || !strings.Contains(err.Error(), "empty") {
+		t.Fatalf("expected empty key error, got %v", err)
+	}
+}
+
+func TestEncryptMediaFileMissingSource(t *testing.T) {
+	key, err := NewMediaLockKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = EncryptMediaFile(filepath.Join(t.TempDir(), "missing.bin"), filepath.Join(t.TempDir(), "out.bin"), key)
+	if err == nil {
+		t.Fatal("expected open error for missing source")
+	}
+}
+
+func TestNewMediaLockKeyLength(t *testing.T) {
+	key, err := NewMediaLockKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(key) != 32 {
+		t.Fatalf("expected 32-byte key, got %d", len(key))
+	}
 }