Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/internal/builder/test_helper_test.go

@@ -0,0 +1,69 @@
+package builder
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"crypto-miner-server/internal/db"
+)
+
+// testWorkspaceRoot walks up from cwd to find the repo root (agent + fusion sources).
+func testWorkspaceRoot(t *testing.T) string {
+	t.Helper()
+	dir, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 10; i++ {
+		if _, err := os.Stat(filepath.Join(dir, "agent", "go.mod")); err == nil {
+			if _, err2 := os.Stat(filepath.Join(dir, "fusion", "main.go")); err2 == nil {
+				return dir
+			}
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			break
+		}
+		dir = parent
+	}
+	t.Skip("workspace root (agent/ and fusion/) not found")
+	return ""
+}
+
+func testHandlerDB(t *testing.T) (*Handler, *db.Database) {
+	t.Helper()
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root := testWorkspaceRoot(t)
+	h := &Handler{
+		db:          database,
+		dataDir:     t.TempDir(),
+		agentSrcDir: filepath.Join(root, "agent"),
+		projectRoot: root,
+		goBinPath:   "go",
+	}
+	return h, database
+}
+
+// setFakeGoFail points goBinPath at a script that always exits non-zero.
+func setFakeGoFail(t *testing.T, h *Handler) {
+	t.Helper()
+	dir := t.TempDir()
+	if runtime.GOOS == "windows" {
+		p := filepath.Join(dir, "go-fail.bat")
+		if err := os.WriteFile(p, []byte("@echo off\r\nexit /b 1\r\n"), 0644); err != nil {
+			t.Fatal(err)
+		}
+		h.goBinPath = p
+		return
+	}
+	p := filepath.Join(dir, "go-fail.sh")
+	if err := os.WriteFile(p, []byte("#!/bin/sh\nexit 1\n"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	h.goBinPath = p
+}