Add S3 erasure swarm with CloudFront signed magnets.

Operators configure bucket and CloudFront domain with env credentials; deploy plans upload RS 4+2 shards and attach signed edge URLs to BGP swarm magnets. Agents fetch LAN, CloudFront, then C2. Forge panel adds test and IAM policy JSON.

server/internal/erasure/lanes.go

@@ -14,9 +14,10 @@ var parallelLaneOrder = []string{
 
 // ShardRef is one erasure shard served on a parallel lane URL.
 type ShardRef struct {
-	Index int    `json:"index"`
-	Lane  string `json:"lane"`
-	URL   string `json:"url"`
+	Index   int    `json:"index"`
+	Lane    string `json:"lane"`
+	URL     string `json:"url"`
+	EdgeURL string `json:"edge_url,omitempty"`
 }
 
 // Plan is deploy-plan metadata for agent-side Reed–Solomon reassembly.