feat(federation): site tag in judge queue + central-mode deploy wiring

Judge site label: SubmissionSummary now carries `site` (from the
submissions.site column, populated in listSubmissions + upsertSubmission
and rippled through the submission:new broadcast). SubmissionList shows
it under the team name so a central judge can tell which team stack a
submission came from; hidden on single-fleet deploys where site is ''.

Central-mode deploy: the existing cloud deploy already carries
FLEET_SECRET and the instance-ingest routes are unconditional, so it IS
the central control plane — no build flag needed. Fixed the reporter's
CENTRAL_API default to the real api ORIGIN (apess-api.redclaw.dev, not
the web host + /api proxy — the reporter calls server-to-server).
Documented the wiring: deploy/.env.example + a "Central control plane"
section in deploy/README.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/components/SubmissionList.test.tsx

@@ -25,4 +25,16 @@ describe('SubmissionList', () => {
     await user.click(screen.getByText('Bravo'))
     expect(onSelect).toHaveBeenCalledWith('b')
   })
+
+  it('shows the site tag when present (central-mode judge) and omits it otherwise', () => {
+    const { rerender } = render(
+      <SubmissionList
+        items={[{ teamId: 'site-a:t1', teamName: 'Alpha', submittedAt: 'x', scored: false, site: 'site-a' }]}
+        onSelect={() => {}}
+      />,
+    )
+    expect(screen.getByTestId('submission-site')).toHaveTextContent('site-a')
+    rerender(<SubmissionList items={items} onSelect={() => {}} />)
+    expect(screen.queryByTestId('submission-site')).toBeNull()
+  })
 })