Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/internal/api/spread_handler.go

@@ -27,6 +27,8 @@ type SpreadHandler struct {
 	erasureShards *erasure.ShardStore
 	deployPlan    *DeployPlanHandler
 	s3CRRConfigFn func() erasure.S3ShardConfig
+	policyPathTracer *PathTracerHandler
+	policyFanoutCfgFn func() PolicyFanoutConfig
 	notesMu       sync.RWMutex
 }