Improve portable launch, forge persistence, and operator auth UX.

Persist build extra_files for Build Manager history, print dashboard login on every start, add libp2p for Mesh P2P forge, defer WebSocket until login, and split devrun.bat from LAUNCH.bat with USB deck auto-detection.

server/web/src/api/client.ts

@@ -3,6 +3,9 @@ import { authHeaders } from './auth';
 
 const API_BASE = '/api/v1';
 
+// Agent-only REST (/agent/decide, /agent/report, /agent/heartbeat) is intentionally
+// omitted here — forged agents call those with X-Fleet-Secret, not dashboard Basic Auth.
+
 async function fetchJSON<T>(url: string, options?: RequestInit): Promise<T> {
   const { headers: extraHeaders, ...rest } = options ?? {};
   const res = await fetch(`${API_BASE}${url}`, {
@@ -118,6 +121,8 @@ export const api = {
   // Health / server
   healthCheck: () => fetchJSON<{ status: string }>('/health'),
   getServerInfo: () => fetchJSON<ServerInfo>('/server/info'),
+  rotateFleetSecret: () =>
+    fetchJSON<{ ok: boolean; hint?: string }>('/server/rotate-secret', { method: 'POST' }),
 
   // Fleet ops
   getAlerts: () => fetchJSON<FleetAlert[]>('/alerts'),