Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/web/src/pages/BuildManagerPage.tsx

@@ -400,12 +400,12 @@ export default function BuildManagerPage() {
       <header className="deck-hero">
         <div className="deck-hero-text">
           <p className="deck-eyebrow font-tech">WORKER BUILDS · DEPLOY &amp; MANAGE</p>
-          <h1 className="font-display bm-title">Build Manager</h1>
-          <p className="form-hint bm-subtitle">
+          <h1>Build Manager</h1>
+          <p className="page-subtitle">
             All forged workers — download, deploy, re-forge, or delete from any browser.
           </p>
         </div>
-        <div className="bm-header-actions">
+        <div className="deck-hero-actions">
           <button type="button" className="btn btn-outline" onClick={loadBuilds} disabled={loading}>
             {loading ? 'Loading…' : '↻ Refresh'}
           </button>