feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

spread-kit-web-publisher/README.md

@@ -7,6 +7,14 @@ Static **waterhole** kit for AetherForge. Upload the folder (or a customized ZIP
 - Netlify / Vercel
 - Owned WordPress / CMS (HTML block or custom page template)
 
+## On-server copy
+
+The same files are synced to `server/web/public/spread/` and served without auth at:
+
+**`https://<your-server>/spread/`**
+
+Use this as the operator instructions page from the login screen and Emberwake tab.
+
 ## Quick start
 
 1. Forge and pin a build in the command deck.
@@ -23,16 +31,24 @@ If you skip the API export, replace in all files:
 | `{{SERVER_URL}}` | `http://192.168.1.50:8989` or your tunnel URL |
 | `{{BUILD_ID}}` | Pinned build UUID (optional) |
 | `{{CAMPAIGN}}` | Default campaign slug |
-| `{{CAMPAIGN_QUERY}}` | `?c=slug` or empty |
+| `{{QUERY_SUFFIX}}` | `?c=slug` or `?pin=uuid&c=slug` |
+| `{{GET_QUERY_SUFFIX}}` | `&pin=uuid&c=slug` or empty |
+| `{{CAMPAIGN_QUERY}}` | Same as `{{QUERY_SUFFIX}}` |
 | `{{PIN_QUERY}}` | `?pin=uuid` or empty |
 
+When served from `/spread/` without export, JavaScript falls back to `window.location.origin` for the server URL and preserves `?c=` / `?pin=` from the page URL.
+
 ## Files
 
-- `index.html` — auto-detects OS, links to installers
+- `index.html` — landing: hero, how-it-works, 3-step guide, platform cards, campaign/CMS/plugin docs
 - `install.ps1` / `install.sh` / `install.command` — curl/irm to your server
-- `assets/aether.css` — dark steampunk styling
+- `assets/aether.css` — dark aether theme (aligned with `/docs/` wiki styling)
 - `campaigns/README.md` — campaign param docs
 
+## Docs wiki
+
+Full threat-intel matrix: [`/docs/SPREAD_TECHNIQUES.md`](/docs/SPREAD_TECHNIQUES.md) on your command-deck server.
+
 ## Public builds (login page)
 
 Unauthenticated downloads also work via `GET /api/v1/public/builds` when the operator enables public builds or marks builds pinned/public.