Fix bugs found in full security and stability audit.

Harden artifact paths and fusion uploads, repair pool reconnect and login ID tracking, fix agent/fusion/frontend regressions, and refresh PROBLEMS.md with the full findings list.

server/web/src/components/SessionGate.tsx

@@ -11,6 +11,7 @@ export default function SessionGate({ children }: { children: ReactNode }) {
   useEffect(() => {
     const token = getStoredAuth();
     if (!token) {
+      setAuthed(false);
       setReady(true);
       return;
     }
@@ -19,20 +20,27 @@ export default function SessionGate({ children }: { children: ReactNode }) {
         setAuthed(r.ok);
         setReady(true);
       })
-      .catch(() => setReady(true));
+      .catch(() => {
+        setAuthed(false);
+        setReady(true);
+      });
   }, []);
 
   const handleLogin = async (e: React.FormEvent) => {
     e.preventDefault();
     setErr('');
     const token = btoa(`${user}:${pass}`);
-    const res = await fetch('/api/v1/config', { headers: { Authorization: `Basic ${token}` } });
-    if (!res.ok) {
-      setErr('Login failed — check username and password.');
-      return;
+    try {
+      const res = await fetch('/api/v1/config', { headers: { Authorization: `Basic ${token}` } });
+      if (!res.ok) {
+        setErr('Login failed — check username and password.');
+        return;
+      }
+      setStoredAuth(user, pass);
+      setAuthed(true);
+    } catch {
+      setErr('Cannot reach server — check that miner-server is running.');
     }
-    setStoredAuth(user, pass);
-    setAuthed(true);
   };
 
   if (!ready) {