Cleanup after LOTL: sync vuln_recon as the tenth tier across server, agent, and UI; tighten gitignore and trim PROBLEMS; dedupe spread docs into a single canonical stub.

server/internal/builder/lotl_onion.go

@@ -4,6 +4,7 @@ import "strings"
 
 // DefaultLotlOnionTiers matches agent/deploy.DefaultLotlOnionTiers — keep in sync.
 var DefaultLotlOnionTiers = []string{
+	"vuln_recon",
 	"docker",
 	"wsl",
 	"powershell",
@@ -18,6 +19,7 @@ var DefaultLotlOnionTiers = []string{
 // NormalizeLotlOnionTiers filters tier ids for forge + server config.
 func NormalizeLotlOnionTiers(raw []string) []string {
 	allowed := map[string]struct{}{
+		"vuln_recon": {},
 		"docker": {}, "wsl": {}, "powershell": {}, "dotnet": {},
 		"bits_curl": {}, "smb": {}, "winrm": {}, "linux": {}, "gpo": {},
 	}