feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

server/web/src/components/SessionGate.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState, type ReactNode } from 'react';
-import type { PublicBuildDTO } from '../types';
+import type { PublicBuildDTO, PublicBuildsResponse } from '../types';
 import {
   AETHERFORGE_CLIENT_HEADER,
   AETHERFORGE_CLIENT_VALUE,
@@ -12,6 +12,7 @@ import {
 } from '../api/auth';
 import { useSound } from '../context/SoundContext';
 import { FlowerOfLifeWatermark, KnowledgeKey } from './Visual/sacredGeometry/motifs';
+import DocsEntryCard from './DocsEntryCard';
 
 export default function SessionGate({ children }: { children: ReactNode }) {
   const { play } = useSound();
@@ -24,6 +25,8 @@ export default function SessionGate({ children }: { children: ReactNode }) {
   const [sessionExpired, setSessionExpired] = useState(false);
   const [publicOpen, setPublicOpen] = useState(false);
   const [publicBuilds, setPublicBuilds] = useState<PublicBuildDTO[]>([]);
+  const [publicBuildsEnabled, setPublicBuildsEnabled] = useState(false);
+  const [publicLatestN, setPublicLatestN] = useState(3);
   const [publicLoading, setPublicLoading] = useState(false);
   const [publicErr, setPublicErr] = useState('');
 
@@ -112,8 +115,10 @@ export default function SessionGate({ children }: { children: ReactNode }) {
     try {
       const res = await fetch('/api/v1/public/builds');
       if (!res.ok) throw new Error('unavailable');
-      const data = (await res.json()) as { builds: PublicBuildDTO[] };
+      const data = (await res.json()) as PublicBuildsResponse;
       setPublicBuilds(data.builds ?? []);
+      setPublicBuildsEnabled(!!data.public_builds_enabled);
+      setPublicLatestN(data.latest_n ?? 3);
       setPublicOpen(true);
     } catch {
       setPublicErr('Public builds are not available yet — forge an installer first.');
@@ -163,20 +168,32 @@ export default function SessionGate({ children }: { children: ReactNode }) {
           <p className="session-gate-whisper" aria-hidden>
             ψ · the deck remembers every key
           </p>
-          <div className="session-public-drawer" style={{ marginTop: '1.25rem', width: '100%' }}>
-            <button
-              type="button"
-              className="btn btn-outline btn-sm"
-              style={{ width: '100%' }}
-              onClick={() => void loadPublicBuilds()}
-              disabled={publicLoading}
-            >
-              {publicLoading ? 'Loading…' : 'Public builds (no login)'}
-            </button>
+          <DocsEntryCard variant="featured" />
+          <div className="session-public-drawer" style={{ marginTop: '1rem', width: '100%' }}>
+            <div style={{ display: 'flex', gap: '0.5rem', flexWrap: 'wrap' }}>
+              <button
+                type="button"
+                className="btn btn-outline btn-sm"
+                style={{ flex: 1, minWidth: '10rem' }}
+                onClick={() => void loadPublicBuilds()}
+                disabled={publicLoading}
+              >
+                {publicLoading ? 'Loading…' : 'Public builds (no login)'}
+              </button>
+              <a
+                href="/spread/"
+                className="btn btn-outline btn-sm"
+                style={{ flex: 1, minWidth: '10rem', textAlign: 'center' }}
+              >
+                Spread Kit
+              </a>
+            </div>
             {publicOpen && (
               <div className="card" style={{ marginTop: '0.75rem', textAlign: 'left' }}>
                 <p className="form-hint" style={{ marginTop: 0 }}>
-                  Pinned + latest forged installers — no credentials required.
+                  {publicBuildsEnabled
+                    ? 'All forged installers exposed — no credentials required.'
+                    : `Pinned + marked-public + latest ${publicLatestN} forged installers — no credentials required.`}
                 </p>
                 {publicErr && <p className="form-hint" style={{ color: 'var(--accent-red)' }}>{publicErr}</p>}
                 {publicBuilds.length === 0 && !publicErr && (