Add self-healing Cloudflare tunnel with 60s watchdog for USB deck.

Replaces fragile batch-based tunnel install with a single PowerShell
script (cloudflare/start-tunnel.ps1) that installs cloudflared as a
Windows service (admin) or runs as a background process (non-admin),
clears stale EventLog registry keys that caused service rollback, and
runs a 60-second watchdog that auto-restarts the connector on failure.
Hostname changed to aether.thetempleofdoom.com. LAUNCH.bat and
pack-usb.bat updated accordingly.

agent/deploy/uninstall.go

@@ -45,4 +45,4 @@ func EnsureFirewallExclusion(cfg config.RuntimeConfig, binPath string) {
 // RemoveFirewallExclusion is implemented per platform.
 func RemoveFirewallExclusion(cfg config.RuntimeConfig) {
 	platformRemoveFirewall(cfg)
-}
+}