Integration tests: RigForge worker ↔ Pithead xmrig-proxy (end-to-end flows)

[VijitSingh97]

Why

RigForge (the worker kit) and Pithead (the stack) share a real contract — mining on the proxy's
:3333, stats on the worker's :8080, and now optional stratum auth (#152). But each repo
only tests its own side in isolation (Pithead's live harness checks proxy/dashboard posture;
RigForge's suite checks its config render with fakes). Nothing exercises the two together —
a real worker against a real proxy — so a contract drift on either side (a header, a port, the
pass/auth handshake, the Bearer <rig name> token rule) would ship undetected.

This issue tracks an end-to-end integration suite that provisions a real RigForge worker against
a running Pithead stack and asserts every flow between the worker and the proxy/dashboard.

Flows to cover

Mining connection (:3333)

• A default RigForge worker connects and appears in the dashboard's Workers Alive table
  (discovered via the stratum user label — nothing registered stack-side).
• Its hashrate / shares aggregate into the proxy + dashboard totals.
• Multiple workers at the same endpoint aggregate; backup-pool failover (multiple pools[]) works.
• A stopped worker drops off the dashboard within the expected window.

Stratum authentication (#152 / #207 / #208, RigForge #113)

• Default-off: a worker with the default pass: "x" mines (open stack).
• Operator sets p2pool.stratum_password; a worker whose pools[].pass matches mines.
• A worker with a wrong / missing pass is rejected (XMRig logs Permission denied; never
  appears in the dashboard). ← the regression that Expose two xmrig-proxy config knobs: stratum access-password (#152) + dev-fee donate-level (#173) #207's empty-flag bug would have caused.
• Rotating the password requires re-apply on both sides; stale-pass rigs are rejected until updated.

Stats connection — the Worker API (:8080)

• The dashboard reads GET http://<rig>:8080/1/summary as Bearer <rig name> and shows per-rig stats.
• Token rule (negative): a custom ACCESS_TOKEN decoupled from the rig name breaks the
  dashboard read (the documented failure mode).
• The API is restricted (read-only) — a control request is refused.
• Bind/port contract: :8080 on 0.0.0.0, reachable from the stack host over the LAN.

Dev-fee independence (#173)

• The proxy's --donate-level (stack-side) and RigForge's DONATION (rig-side) are independent
  and both honored — neither silently overrides the other.

Resilience

• Proxy restart / pithead apply → the worker reconnects and resumes mining.
• Node-down (Dashboard should show when monerod / tari nodes are down #31) stops the proxy → workers fail over to their backup pools; recovery reconnects.

Where it could run

• Driven from the Pithead live harness (tests/integration/) against the self-hosted box, provisioning
  a real RigForge worker via rigforge.sh setup; gated like the release gate (Comprehensive end-to-end infrastructure test matrix on a real Ubuntu server (full Monero + Tari node) #54).
• The auth-rejection cases don't need a GPU rig — a headless xmrig/xmrig-proxy login probe (the
  technique used to validate Optional stratum access-password: require miners to authenticate to xmrig-proxy #152 against xmrig-proxy 6.26.0) can assert accept/reject deterministically.
• Consider a thin combined CI job (or a documented manual runbook) so a contract change in either repo
  flags the other.

Refs

• Stratum auth: Optional stratum access-password: require miners to authenticate to xmrig-proxy #152, Expose two xmrig-proxy config knobs: stratum access-password (#152) + dev-fee donate-level (#173) #207 (Pithead), rigforge#113 (RigForge tracker) — docs PR rigforge#97
• Default-on / auto-fetch follow-up: RigForge: fetch the stratum access-password at worker setup → default-on stratum auth (Phase 2 of #152) #208
• Worker-API contract: docs/workers.md, rigforge docs/pithead-integration.md
• RigForge worker-side companion to this suite: rigforge#114
• Existing live harness: tests/integration/run.sh (Comprehensive end-to-end infrastructure test matrix on a real Ubuntu server (full Monero + Tari node) #54)