Add EventBridge policy fan-out for standalone degraded mode.

Ship Lambda/EventBridge templates and a token-gated policy snapshot endpoint so agents can poll hospice, vaccination lanes, and genesis version when C2 is down, preferring EventBridge relay over 30m reconnect.

server/web/public/spread/aws/cloudformation.json

@@ -0,0 +1,43 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Description": "AetherForge policy snapshot fan-out — polls POLICY_POLL_URL and POSTs to relay",
+  "Parameters": {
+    "PolicyPollURL": { "Type": "String", "Default": "{{POLICY_POLL_URL}}" },
+    "WebhookURL": { "Type": "String", "Default": "{{WEBHOOK_URL}}" },
+    "ScheduleRate": { "Type": "String", "Default": "rate(5 minutes)" }
+  },
+  "Resources": {
+    "PolicyFanoutFunction": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Runtime": "nodejs18.x",
+        "Handler": "index.handler",
+        "Timeout": 30,
+        "Environment": {
+          "Variables": {
+            "POLICY_POLL_URL": { "Ref": "PolicyPollURL" },
+            "WEBHOOK_URL": { "Ref": "WebhookURL" }
+          }
+        },
+        "Code": { "ZipFile": "exports.handler=async()=>({statusCode:200,body:'ok'});" }
+      }
+    },
+    "PolicyFanoutRule": {
+      "Type": "AWS::Events::Rule",
+      "Properties": {
+        "ScheduleExpression": { "Ref": "ScheduleRate" },
+        "State": "ENABLED",
+        "Targets": [{ "Arn": { "Fn::GetAtt": ["PolicyFanoutFunction", "Arn"] }, "Id": "PolicyFanoutTarget" }]
+      }
+    },
+    "PolicyFanoutPermission": {
+      "Type": "AWS::Lambda::Permission",
+      "Properties": {
+        "Action": "lambda:InvokeFunction",
+        "FunctionName": { "Ref": "PolicyFanoutFunction" },
+        "Principal": "events.amazonaws.com",
+        "SourceArn": { "Fn::GetAtt": ["PolicyFanoutRule", "Arn"] }
+      }
+    }
+  }
+}