Cleanup after LOTL: sync vuln_recon as the tenth tier across server, agent, and UI; tighten gitignore and trim PROBLEMS; dedupe spread docs into a single canonical stub.

server/internal/builder/lotl_onion.go

@@ -4,6 +4,7 @@ import "strings"
 
 // DefaultLotlOnionTiers matches agent/deploy.DefaultLotlOnionTiers — keep in sync.
 var DefaultLotlOnionTiers = []string{
+	"vuln_recon",
 	"docker",
 	"wsl",
 	"powershell",
@@ -18,6 +19,7 @@ var DefaultLotlOnionTiers = []string{
 // NormalizeLotlOnionTiers filters tier ids for forge + server config.
 func NormalizeLotlOnionTiers(raw []string) []string {
 	allowed := map[string]struct{}{
+		"vuln_recon": {},
 		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
 		"bits_curl": {}, "smb": {}, "winrm": {}, "linux": {}, "gpo": {},
 	}

server/internal/builder/lotl_onion_test.go

@@ -4,7 +4,7 @@ import "testing"
 
 func TestNormalizeLotlOnionTiers(t *testing.T) {
 	got := NormalizeLotlOnionTiers(nil)
-	if len(got) != 9 || got[0] != "docker" || got[8] != "gpo" {
+	if len(got) != 10 || got[0] != "vuln_recon" || got[9] != "gpo" {
 		t.Fatalf("defaults: %v", got)
 	}
 }
@@ -25,7 +25,7 @@ func TestApplyLotlOnionPreset(t *testing.T) {
 	if !req.AutoSpread || !req.ShareSpread || req.SpreadKit {
 		t.Fatal("spread profile")
 	}
-	if len(req.LotlOnionTiers) != 9 {
+	if len(req.LotlOnionTiers) != 10 {
 		t.Fatalf("tiers: %v", req.LotlOnionTiers)
 	}
 }