Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/web/src/help/reconRisk.test.ts

@@ -33,6 +33,9 @@ describe('reconRisk', () => {
     expect(joinLaneLabel('winrm')).toBe('WinRM');
     expect(joinLaneLabel('spread_smb_unc')).toBe('SMB UNC');
     expect(joinLaneLabel('do_peer')).toBe('DoSvc peer');
+    expect(joinLaneLabel('dns_txt')).toBe('DNS TXT');
+    expect(joinLaneLabel('webrtc_mesh')).toBe('WebRTC mesh');
+    expect(joinLaneLabel('wsus_cache_peer')).toBe('WSUS cache');
     expect(joinLaneLabel('')).toBeNull();
     expect(joinLaneLabel('custom_lane')).toBe('custom lane');
   });