Add browser deploy recon backend with port scan, web crawl, and deploy lane recommendations.

POST /api/v1/recon/scan probes fleet ports from the server host, crawls owned HTTP targets, maps findings to spread lanes, and records optional oath ledger rows.

server/main.go

@@ -351,6 +351,9 @@ func main() {
 		func() string { return cfg.Server.PolicySnapshotToken },
 	)
 	spreadHandler.BindPolicyFanout(pathTracerHandler, policyFanoutCfgFn)
+	spreadHandler.BindDeployPlan(deployPlanHandler, func() string { return configProvider.PublicURL() }, func() map[string]api.ServiceDeployLane {
+		return apiServiceDeployAllowlist(cfg.Server.ServiceDeployAllowlist)
+	})
 	wsHub.SetPolicyFanoutConfig(cfg.Server.PolicySnapshotToken, cfg.Server.EventBridgeRelayURL, func() string {
 		return configProvider.PublicURL()
 	})