Fix bugs found in full security and stability audit.

Harden artifact paths and fusion uploads, repair pool reconnect and login ID tracking, fix agent/fusion/frontend regressions, and refresh PROBLEMS.md with the full findings list.

agent/client/client.go

@@ -112,6 +112,10 @@ func (c *AgentClient) connectLoop() error {
 	c.conn = conn
 	defer conn.Close()
 
+	conn.SetPongHandler(func(string) error {
+		return conn.SetReadDeadline(time.Now().Add(90 * time.Second))
+	})
+
 	if err := c.authenticate(); err != nil {
 		return err
 	}
@@ -183,12 +187,24 @@ func (c *AgentClient) authenticate() error {
 func (c *AgentClient) handleMessage(msg Message) {
 	switch msg.Type {
 	case "new_job":
+		var raw map[string]json.RawMessage
+		if err := json.Unmarshal(msg.Payload, &raw); err != nil {
+			log.Printf("[agent] bad job payload: %v", err)
+			return
+		}
+		if errMsg, ok := raw["error"]; ok {
+			log.Printf("[agent] job error from server: %s", string(errMsg))
+			c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
+			return
+		}
 		var j job.Job
 		if err := json.Unmarshal(msg.Payload, &j); err != nil {
 			log.Printf("[agent] bad job payload: %v", err)
 			return
 		}
 		if j.Blob == "" {
+			log.Printf("[agent] empty job blob — requesting job again")
+			c.write(Message{Type: "get_job", Payload: json.RawMessage("{}")})
 			return
 		}
 		log.Printf("[agent] new job %s height=%d", j.ID, j.Height)