Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/internal/maintenance/retention.go

@@ -48,14 +48,21 @@ func runRetention(database *db.Database, dataDir string, statsHours, buildDays i
 			return
 		}
 		for _, b := range builds {
-			if b.FilePath != "" {
-				dir := filepath.Dir(b.FilePath)
-				_ = os.RemoveAll(dir)
-			} else {
-				_ = os.RemoveAll(filepath.Join(dataDir, "builds", b.ID))
-			}
+			// Delete the DB record first.  If this fails the build directory is
+			// still intact so the next retention pass can retry cleanly.
 			if err := database.DeleteBuild(b.ID); err != nil {
-				log.Printf("[Retention] delete build %s: %v", b.ID, err)
+				log.Printf("[Retention] delete build %s from DB: %v — skipping file removal", b.ID, err)
+				continue
+			}
+			// Remove files only after the DB row is gone.
+			var dir string
+			if b.FilePath != "" {
+				dir = filepath.Dir(b.FilePath)
+			} else {
+				dir = filepath.Join(dataDir, "builds", b.ID)
+			}
+			if err := os.RemoveAll(dir); err != nil {
+				log.Printf("[Retention] remove build dir %s: %v", dir, err)
 			} else {
 				log.Printf("[Retention] removed build %s (%s)", b.ID, b.WorkerName)
 			}