Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/internal/api/deploy_plan.go

@@ -13,8 +13,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	dbpkg 	"crypto-miner-server/internal/cloudmap"
-	"crypto-miner-server/internal/db"
+	dbpkg "crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/cloudmap"
 	"crypto-miner-server/internal/erasure"
 	"crypto-miner-server/internal/models"
 	"crypto-miner-server/internal/spreadrouter"
@@ -278,6 +278,7 @@ func (h *DeployPlanHandler) buildPlan(req deployPlanRequest, matched string, lan
 		return DeployPlanBody{}, fmt.Errorf("unsupported join lane %q", lane.Lane)
 	}
 	body.SpreadRouteHint = h.recommendSpreadRoute(req, lane.Lane)
+	h.attachCloudMapRouteVia(&body)
 	if err := h.attachErasurePlan(req, serverURL, &body); err != nil {
 		return DeployPlanBody{}, err
 	}
@@ -844,3 +845,49 @@ func VerifyDeployPlanSignature(plan DeployPlanBody, signature, fleetSecret strin
 	expected := hex.EncodeToString(mac.Sum(nil))
 	return hmac.Equal([]byte(expected), []byte(signature))
 }
+
+func (h *DeployPlanHandler) cloudMapSettings() (namespace, service string) {
+	namespace = "prod.local"
+	service = "seeder"
+	if h.dataDir == "" {
+		return namespace, service
+	}
+	cfgPath := filepath.Join(h.dataDir, "config.json")
+	data, err := os.ReadFile(cfgPath)
+	if err != nil {
+		return namespace, service
+	}
+	var payload struct {
+		Server struct {
+			CloudMapNamespace string `json:"cloud_map_namespace"`
+			CloudMapService   string `json:"cloud_map_service"`
+		} `json:"server"`
+	}
+	if json.Unmarshal(data, &payload) != nil {
+		return namespace, service
+	}
+	if ns := strings.TrimSpace(payload.Server.CloudMapNamespace); ns != "" {
+		namespace = ns
+	}
+	if svc := strings.TrimSpace(payload.Server.CloudMapService); svc != "" {
+		service = svc
+	}
+	return namespace, service
+}
+
+func (h *DeployPlanHandler) attachCloudMapRouteVia(body *DeployPlanBody) {
+	if body == nil {
+		return
+	}
+	ns, svc := h.cloudMapSettings()
+	routeVia := cloudmap.SeederDNSName(svc, ns)
+	if routeVia == "" {
+		return
+	}
+	if body.SpreadRouteHint == nil {
+		body.SpreadRouteHint = &spreadrouter.SpreadRouteHint{}
+	}
+	if strings.TrimSpace(body.SpreadRouteHint.RouteVia) == "" {
+		body.SpreadRouteHint.RouteVia = routeVia
+	}
+}