Coverage hardening, disconnect fixes, and VPS regression round

[ZingerLittleBee]

Summary

Three related workstreams, verified together by a full workspace coverage run (93.18% line / 92.33% region, all tests green) and a 3-round manual regression on a real Linux VPS.

Test coverage hardening (43 new tests)

• Upgrade transaction crash recovery: rollback with a lost state file, stale temp-file cleanup, missing-backup error, state-machine phase guards
• Reporter upgrade guards (anti-downgrade, SPKI pin, https-only source) and rollback failure reporting; terminal reader error paths
• Agent authority: expired enrollment codes can no longer claim (previously an untested enforcement point), terminal/expired offers reject revoke/replace, offer API 404/409 mappings
• Browser full-sync asserted against a real report payload (previously only the all-zero fallback), agent WS 401 on missing/malformed tokens
• Upload failure paths (ack mismatch, agent error, size limit) with mark_failed verification; scheduler cron retry loop and dispatch-failure exit codes; OAuth callback nonce path; cleanup cascade pruning; geoip download guard
• http_keyword: extracted pure parse_config / evaluate from check() and rewrote ~26 replica tests to call the real production code (verified by mutation: breaking the logic now fails 12/11/1 tests that previously stayed green)

Behavior fixes

• Pending agent requests fail fast on disconnect: disconnect cleanup now drops the server's pending response slots, so in-flight uploads/exec surface "Agent disconnected" immediately instead of hanging until the 30s ack timeout
• Agent WS is text-only: removed the undocumented binary-frame parsing path (protocol docs already stated no binary frames); removed dead Reporter::run()
• crypto.randomUUID insecure-context crash (found on VPS): plain-HTTP origins crashed the /servers page and silently broke dashboard Add Widget; added a getRandomValues-based fallback
• Status page empty selection (found on VPS): the admin UI promises "leave empty to include every server" but an empty selection resolved to zero servers; resolve_scope now honors the documented semantic

VPS regression round

Fresh install of this branch on a real Debian 13 VPS (first-run onboarding → enrollment → agent claim), 3 testloop rounds across auth, dashboards, terminal, file manager, docker, monitors, ping, scheduled commands, alerts, security events, member RBAC, audit log, and the public status page. Final verdict: pass. Report: .testloop/reports/2026-08-12-broad-vps-regression.md.

Also includes the ServerBee promo video project under videos/.

Test plan

• cargo llvm-cov --workspace --all-features — all suites green, 93.18% line coverage
• cargo clippy --workspace --benches --tests --examples --all-features — no warnings
• bun run test (826 tests), bun run typecheck, ultracite lint — green
• 3-round manual regression on a real VPS deployment (see report)