Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/config.go

@@ -120,6 +120,8 @@ type ServerSettings struct {
 	FargateBurstExpiresAt     string `json:"fargate_burst_expires_at,omitempty"`
 	CloudMapNamespace         string `json:"cloud_map_namespace,omitempty"`
 	CloudMapService           string `json:"cloud_map_service,omitempty"`
+	PolicySnapshotToken       string `json:"policy_snapshot_token,omitempty"`
+	EventBridgeRelayURL       string `json:"eventbridge_relay_url,omitempty"`
 }
 
 // WebRTCMeshPolicySettings is Calibrate policy for WebRTC LAN seed spread.