Improve portable launch, forge persistence, and operator auth UX.

Persist build extra_files for Build Manager history, print dashboard login on every start, add libp2p for Mesh P2P forge, defer WebSocket until login, and split devrun.bat from LAUNCH.bat with USB deck auto-detection.

server/internal/api/router_test.go

@@ -28,6 +28,9 @@ func resetAuthState(t *testing.T) {
 	authUsers = map[string]string{}
 	usersFilePath = ""
 	usersMu.Unlock()
+	authLoadMu.Lock()
+	authLoadedDataDir = ""
+	authLoadMu.Unlock()
 	SetAgentPathSecret("")
 	SetRotateSecretFn(nil)
 	t.Cleanup(resetAuthGlobals)
@@ -437,3 +440,35 @@ func TestRouterNoWebRootFallback(t *testing.T) {
 		t.Fatalf("unexpected body: %s", rec.Body.String())
 	}
 }
+
+func TestLoadUsersCreatesAndReloadsLoginSidecar(t *testing.T) {
+	resetAuthState(t)
+	dataDir := t.TempDir()
+
+	LoadUsers(dataDir)
+
+	sidecarPath := filepath.Join(dataDir, "login-credentials.json")
+	data, err := os.ReadFile(sidecarPath)
+	if err != nil {
+		t.Fatalf("login sidecar: %v", err)
+	}
+	var creds map[string]string
+	if err := json.Unmarshal(data, &creds); err != nil {
+		t.Fatal(err)
+	}
+	pw, ok := creds["admin"]
+	if !ok || pw == "" {
+		t.Fatalf("expected admin password in sidecar: %v", creds)
+	}
+	if !checkPassword(authUsers["admin"], pw) {
+		t.Fatal("sidecar password should match users.json hash")
+	}
+
+	if err := saveUser("admin", "new-secret-pass"); err != nil {
+		t.Fatal(err)
+	}
+	reloaded, err := readLoginSidecar(sidecarPath)
+	if err != nil || reloaded["admin"] != "new-secret-pass" {
+		t.Fatalf("sidecar not updated after saveUser: %v err=%v", reloaded, err)
+	}
+}