Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/internal/api/erasure_swarm_test.go

@@ -0,0 +1,34 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"crypto-miner-server/internal/erasure"
+)
+
+type okStore struct{}
+
+func (okStore) PutShard(context.Context, string, string, []byte) error { return nil }
+func (okStore) HeadBucket(context.Context, string) error               { return nil }
+
+func TestErasureSwarmPostTestOK(t *testing.T) {
+	os.Setenv("AF_AWS_ACCESS_KEY_ID", "A")
+	os.Setenv("AF_AWS_SECRET_ACCESS_KEY", "s")
+	defer os.Unsetenv("AF_AWS_ACCESS_KEY_ID")
+	defer os.Unsetenv("AF_AWS_SECRET_ACCESS_KEY")
+	h := NewErasureSwarmHandler(func() erasure.AWSSwarmSettings {
+		return erasure.AWSSwarmSettings{S3Bucket: "b", CloudFrontDomain: "d.cf.net"}
+	}, func() erasure.ShardObjectStore { return okStore{} })
+	rec := httptest.NewRecorder()
+	h.PostTest(rec, httptest.NewRequest(http.MethodPost, "/", nil))
+	var body erasureSwarmTestResponse
+	_ = json.NewDecoder(rec.Body).Decode(&body)
+	if !body.OK {
+		t.Fatalf("%+v", body)
+	}
+}