Add self-healing Cloudflare tunnel with 60s watchdog for USB deck.

Replaces fragile batch-based tunnel install with a single PowerShell
script (cloudflare/start-tunnel.ps1) that installs cloudflared as a
Windows service (admin) or runs as a background process (non-admin),
clears stale EventLog registry keys that caused service rollback, and
runs a 60-second watchdog that auto-restarts the connector on failure.
Hostname changed to aether.thetempleofdoom.com. LAUNCH.bat and
pack-usb.bat updated accordingly.

cloudflare/verify-tunnel.bat

@@ -0,0 +1,52 @@
+@echo off
+setlocal EnableExtensions EnableDelayedExpansion
+title AetherForge — Tunnel Verify
+
+set "ROOT=%~dp0.."
+if "%ROOT:~-1%"=="\" set "ROOT=%ROOT:~0,-1%"
+
+set "CF_CONFIG_JSON=%ROOT%\cloudflare\tunnel-config.json"
+set "CF_HOSTNAME=killa.thetempleofdoom.com"
+set "CF_ORIGIN=http://127.0.0.1:8989"
+
+if exist "%CF_CONFIG_JSON%" (
+    for /f "usebackq delims=" %%L in (`powershell -NoProfile -Command "(Get-Content '%CF_CONFIG_JSON%' -Raw | ConvertFrom-Json).hostname"`) do set "CF_HOSTNAME=%%L"
+    for /f "usebackq delims=" %%L in (`powershell -NoProfile -Command "(Get-Content '%CF_CONFIG_JSON%' -Raw | ConvertFrom-Json).origin"`) do set "CF_ORIGIN=%%L"
+)
+
+echo.
+echo  ================================================================
+echo       AetherForge  —  Tunnel Verification
+echo  ================================================================
+echo   Hostname:   https://%CF_HOSTNAME%
+echo   Origin:     %CF_ORIGIN%
+echo  ================================================================
+echo.
+
+echo [1] cloudflared service
+sc query cloudflared 2>nul
+if errorlevel 1 echo   FAIL: cloudflared service not installed
+echo.
+
+echo [2] DNS for %CF_HOSTNAME%
+nslookup %CF_HOSTNAME% 2>nul
+echo   NOTE: URL must be killa.thetempleofdoom.com (two l's), not kill.
+echo.
+
+echo [3] Local AetherForge (%CF_ORIGIN%)
+powershell -NoProfile -Command "try { $r = Invoke-WebRequest -Uri '%CF_ORIGIN%/' -UseBasicParsing -TimeoutSec 5; Write-Host ('  OK HTTP ' + $r.StatusCode) } catch { Write-Host ('  FAIL: ' + $_.Exception.Message) }"
+echo.
+
+echo [4] Public tunnel https://%CF_HOSTNAME%/
+powershell -NoProfile -Command "try { $r = Invoke-WebRequest -Uri 'https://%CF_HOSTNAME%/' -UseBasicParsing -TimeoutSec 15; Write-Host ('  OK HTTP ' + $r.StatusCode) } catch { Write-Host ('  FAIL: ' + $_.Exception.Message) }"
+echo.
+
+echo [5] Local config on this PC
+if exist "%ProgramData%\AetherForge\.cloudflared\config.yml" (
+    type "%ProgramData%\AetherForge\.cloudflared\config.yml"
+) else (
+    echo   FAIL: %ProgramData%\AetherForge\.cloudflared\config.yml not found
+    echo   Run LAUNCH.bat as Administrator once.
+)
+echo.
+pause