Add dns_txt, webrtc_mesh, and wsus_cache_peer LOTL deploy tiers with Forge toggles.

Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.

server/web/src/pages/PathTracerPage.tsx

@@ -246,10 +246,10 @@ export default function PathTracerPage() {
       <header className="deck-hero">
         <div className="deck-hero-text">
           <p className="deck-eyebrow font-tech">NETWORK OPS · WIREGUARD</p>
-          <h1 className="pt-title">⬡ Path Tracer <HelpTip field="pt_path_tracer" /></h1>
-          <div className="pt-subtitle">
+          <h1>⬡ Path Tracer <HelpTip field="pt_path_tracer" /></h1>
+          <p className="page-subtitle">
             Build an on-demand multi-hop WireGuard VPN — select up to 3 agents, click TRACE.
-          </div>
+          </p>
         </div>
       </header>