feat(federation): site tag in judge queue + central-mode deploy wiring

Judge site label: SubmissionSummary now carries `site` (from the
submissions.site column, populated in listSubmissions + upsertSubmission
and rippled through the submission:new broadcast). SubmissionList shows
it under the team name so a central judge can tell which team stack a
submission came from; hidden on single-fleet deploys where site is ''.

Central-mode deploy: the existing cloud deploy already carries
FLEET_SECRET and the instance-ingest routes are unconditional, so it IS
the central control plane — no build flag needed. Fixed the reporter's
CENTRAL_API default to the real api ORIGIN (apess-api.redclaw.dev, not
the web host + /api proxy — the reporter calls server-to-server).
Documented the wiring: deploy/.env.example + a "Central control plane"
section in deploy/README.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/components/SubmissionList.tsx

@@ -31,6 +31,14 @@ export function SubmissionList({ items, selectedId, onSelect }: SubmissionListPr
             <span className="text-sm font-medium truncate">{s.teamName || s.teamId}</span>
             {s.scored && <Badge className="font-mono text-[8px] uppercase tracking-wider">scored</Badge>}
           </div>
+          {s.site && (
+            <div
+              data-testid="submission-site"
+              className="font-mono text-[9px] uppercase tracking-widest text-muted-foreground truncate mt-0.5"
+            >
+              {s.site}
+            </div>
+          )}
         </button>
       ))}
     </div>