Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/main.go

@@ -178,7 +178,7 @@ func main() {
 			applyRuntimeConfig(c, wsHub, poolManager, builderHandler)
 		},
 	}
-	configHandler := api.NewConfigHandler(database, configProvider)
+	configHandler := api.NewConfigHandler(configProvider)
 	log.Println("Config handler initialized")
 
 	maintenance.StartRetentionJobs(database, cfg.DataDir, cfg.Server.StatsRetentionHours, cfg.Server.BuildRetentionDays)
@@ -324,6 +324,26 @@ func (p *serverConfigProvider) UpdateConfigFromJSON(data json.RawMessage) error
 		return fmt.Errorf("invalid config: %w", err)
 	}
 
+	// Semantic validation — reject values that would break the server at runtime.
+	if incoming.Port != 0 && (incoming.Port < 1 || incoming.Port > 65535) {
+		return fmt.Errorf("invalid config: port %d out of range (1–65535)", incoming.Port)
+	}
+	if incoming.Pool.Port != 0 && (incoming.Pool.Port < 1 || incoming.Pool.Port > 65535) {
+		return fmt.Errorf("invalid config: pool.port %d out of range (1–65535)", incoming.Pool.Port)
+	}
+	if incoming.Server.MaxAgents < 0 {
+		return fmt.Errorf("invalid config: server.max_agents must be ≥ 0")
+	}
+	if incoming.Server.StatsRetentionHours < 0 {
+		return fmt.Errorf("invalid config: server.stats_retention_hours must be ≥ 0")
+	}
+	if incoming.Server.BuildRetentionDays < 0 {
+		return fmt.Errorf("invalid config: server.build_retention_days must be ≥ 0")
+	}
+	if incoming.Server.MaxBuildSizeMB < 0 {
+		return fmt.Errorf("invalid config: server.max_build_size_mb must be ≥ 0")
+	}
+
 	// Determine which top-level keys were explicitly present in the JSON payload.
 	// This prevents partial PUTs from corrupting boolean fields (H14): a key absent
 	// from the payload is treated as "not changed", not "set to false".