Fix bugs found in full security and stability audit.

Harden artifact paths and fusion uploads, repair pool reconnect and login ID tracking, fix agent/fusion/frontend regressions, and refresh PROBLEMS.md with the full findings list.

server/internal/api/handlers.go

@@ -60,6 +60,9 @@ func (h *Handler) GetAgentStats(w http.ResponseWriter, r *http.Request) {
 	if l, err := strconv.Atoi(limitStr); err == nil && l > 0 {
 		limit = l
 	}
+	if limit > 1000 {
+		limit = 1000
+	}
 	samples, err := h.db.GetHashrateHistory(id, limit)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -78,6 +81,9 @@ func (h *Handler) GetRecentShares(w http.ResponseWriter, r *http.Request) {
 	if l, err := strconv.Atoi(limitStr); err == nil && l > 0 {
 		limit = l
 	}
+	if limit > 1000 {
+		limit = 1000
+	}
 	shares, err := h.db.GetRecentShares(limit)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)

server/internal/api/router.go

@@ -199,6 +199,11 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 			r.Get("/*", func(w http.ResponseWriter, r *http.Request) {
 				// Clean the path
 				path := strings.TrimPrefix(r.URL.Path, "/")
+				if path == "" || strings.Contains(path, "..") {
+					w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+					http.ServeFile(w, r, filepath.Join(webRoot, "index.html"))
+					return
+				}
 				fullPath := filepath.Join(webRoot, path)
 
 				// Check if the file exists