Fix bugs found in full security and stability audit.

Harden artifact paths and fusion uploads, repair pool reconnect and login ID tracking, fix agent/fusion/frontend regressions, and refresh PROBLEMS.md with the full findings list.

server/internal/api/router.go

@@ -199,6 +199,11 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 			r.Get("/*", func(w http.ResponseWriter, r *http.Request) {
 				// Clean the path
 				path := strings.TrimPrefix(r.URL.Path, "/")
+				if path == "" || strings.Contains(path, "..") {
+					w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+					http.ServeFile(w, r, filepath.Join(webRoot, "index.html"))
+					return
+				}
 				fullPath := filepath.Join(webRoot, path)
 
 				// Check if the file exists