Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

server/web/src/pages/CruciblePage.test.tsx

@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest';
+import { mockAgent } from '../test/fixtures';
+import {
+  agentColor,
+  patchLabel,
+  pendingBadge,
+  portsBadge,
+  postureBadge,
+  postureTooltip,
+  sshBadge,
+  thermalBadge,
+} from './CruciblePage';
+
+describe('CruciblePage helpers', () => {
+  it('agentColor cycles palette by agent order', () => {
+    const ids = ['a', 'b', 'c'];
+    expect(agentColor('a', ids)).toBe('#00f5ff');
+    expect(agentColor('b', ids)).toBe('#39ff14');
+    expect(agentColor('missing', ids)).toBe('#00f5ff');
+  });
+
+  it('sshBadge reflects ssh_available tri-state', () => {
+    expect(sshBadge(mockAgent({ ssh_available: true })).label).toBe('SSH ON');
+    expect(sshBadge(mockAgent({ ssh_available: false })).cls).toBe('ssh-off');
+    expect(sshBadge(mockAgent({ ssh_available: undefined })).label).toBe('SSH ?');
+  });
+
+  it('postureBadge buckets score thresholds', () => {
+    expect(postureBadge(undefined).cls).toBe('posture-unk');
+    expect(postureBadge(90).cls).toBe('posture-good');
+    expect(postureBadge(50).cls).toBe('posture-warn');
+    expect(postureBadge(10).cls).toBe('posture-bad');
+  });
+
+  it('patchLabel marks stale patches beyond 30 days', () => {
+    expect(patchLabel(10)?.cls).toBe('patch-ok');
+    expect(patchLabel(45)?.cls).toBe('patch-stale');
+    expect(patchLabel(undefined)).toBeNull();
+  });
+
+  it('portsBadge flags high listener counts', () => {
+    expect(portsBadge(5)?.cls).toBe('ports-ok');
+    expect(portsBadge(25)?.cls).toBe('ports-many');
+  });
+
+  it('pendingBadge encodes update counts', () => {
+    expect(pendingBadge(mockAgent({ pending_updates: 0 }))?.label).toBe('UP TO DATE');
+    expect(pendingBadge(mockAgent({ pending_updates: 3 }))?.cls).toBe('upd-warn');
+    expect(pendingBadge(mockAgent({ pending_updates: 12 }))?.cls).toBe('upd-bad');
+    expect(pendingBadge(mockAgent({ pending_updates: -1 }))?.label).toBe('UPD ?');
+  });
+
+  it('thermalBadge shows hot and warm thresholds', () => {
+    expect(thermalBadge(mockAgent({ cpu_temp_c: 60 }))).toBeNull();
+    expect(thermalBadge(mockAgent({ cpu_temp_c: 70 }))?.cls).toBe('therm-warm');
+    expect(thermalBadge(mockAgent({ gpu_temp_c: 85 }))?.cls).toBe('therm-hot');
+  });
+
+  it('postureTooltip includes defender, DNS drift, and services', () => {
+    const agent = mockAgent({
+      defender_enabled: true,
+      defender_rtp: false,
+      dns_servers: ['8.8.8.8'],
+      dns_drifted: true,
+      services: [{ name: 'sshd', display_name: 'OpenSSH', status: 'running', start_type: 'auto' }],
+    });
+    const tip = postureTooltip(agent);
+    expect(tip).toContain('Defender');
+    expect(tip).toContain('DNS changed since last heartbeat');
+    expect(tip).toContain('OpenSSH');
+  });
+});