feat: add 12 more Ayo-tier cartridges — hit 50 total

Cloud & infrastructure (9):
  - aws-mcp: AWS multi-service (S3/EC2/Lambda/SQS/DynamoDB), SigV4 auth
  - gcp-mcp: GCP multi-service, configurable project_id, quota tracking
  - hetzner-mcp: Hetzner Cloud API, per-second rate limiting
  - fly-mcp: Fly.io Machines API v1
  - railway-mcp: Railway GraphQL API v2
  - render-mcp: Render REST API, 100 req/min rate limit
  - digitalocean-mcp: DigitalOcean API, 5000 req/hour
  - linode-mcp: Akamai/Linode API, 800 req/2min
  - docker-hub-mcp: Docker Hub with two-phase JWT auth, pull rate tracking

Database connectors (3):
  - neon-mcp: Neon serverless Postgres, auto-suspend endpoints
  - turso-mcp: Turso/libSQL, edge-replica-aware
  - supabase-mcp: Supabase PostgREST + Auth + Storage + Functions

All 12 build-verified (zig build + zig build test), validated clean,
PanLL panel manifests generated. SPDX PMPL-1.0-or-later throughout.

Cartridge count: 50 (24 original + 26 new this session).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/servers/menu.a2ml

@@ -518,3 +518,147 @@
   hash       = ""
   notes      = "MongoDB database cartridge with BSON document handling, aggregation pipelines, and wire protocol integration"
 @end
+
+
+@cartridge(id="neon-mcp"):
+  name       = "neon-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Database
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Neon serverless Postgres MCP cartridge — projects, branches, endpoints, queries"
+@end
+
+
+@cartridge(id="turso-mcp"):
+  name       = "turso-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Database
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Turso libSQL MCP cartridge — databases, groups, replicas, queries"
+@end
+
+
+@cartridge(id="supabase-mcp"):
+  name       = "supabase-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Database
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Supabase MCP cartridge — PostgREST, Auth, Storage, Functions"
+@end
+
+
+@cartridge(id="fly-mcp"):
+  name       = "fly-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Fly.io Machines API v1 cartridge -- apps, machines, volumes, secrets, regions, IPs"
+@end
+
+
+@cartridge(id="railway-mcp"):
+  name       = "railway-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "railway-mcp cartridge"
+@end
+
+
+@cartridge(id="render-mcp"):
+  name       = "render-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Render REST API v1 cartridge -- services, deploys, env groups, custom domains, jobs, bandwidth"
+@end
+
+
+@cartridge(id="aws-mcp"):
+  name       = "aws-mcp"
+  version    = "0.2.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "AWS cloud cartridge — Signature V4 auth, multi-service routing (S3/EC2/Lambda/SQS/DynamoDB) with rate-limit back-pressure"
+@end
+
+
+@cartridge(id="gcp-mcp"):
+  name       = "gcp-mcp"
+  version    = "0.2.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "GCP cloud cartridge — service account/OAuth2 auth, multi-service routing (Compute/Storage/Functions/PubSub/BigQuery/IAM) with quota tracking"
+@end
+
+
+@cartridge(id="hetzner-mcp"):
+  name       = "hetzner-mcp"
+  version    = "0.2.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Hetzner Cloud cartridge — Bearer token auth, server/volume/firewall/network management with per-second rate limiting"
+@end
+
+
+@cartridge(id="digitalocean-mcp"):
+  name       = "digitalocean-mcp"
+  version    = "0.2.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "DigitalOcean cloud infrastructure MCP cartridge — droplets, volumes, domains, SSH keys, snapshots, databases"
+@end
+
+
+@cartridge(id="linode-mcp"):
+  name       = "linode-mcp"
+  version    = "0.2.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Linode/Akamai cloud infrastructure MCP cartridge — instances, volumes, domains, NodeBalancers, StackScripts, images"
+@end
+
+
+@cartridge(id="docker-hub-mcp"):
+  name       = "docker-hub-mcp"
+  version    = "0.2.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Container
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Docker Hub container registry MCP cartridge — images, tags, namespaces, manifests, repositories, stars"
+@end

cartridges/aws-mcp/README.adoc

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+= aws-mcp
+Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+:spdx: PMPL-1.0-or-later
+:tier: Ayo
+:domain: Cloud
+:protocols: MCP, REST
+
+== Overview
+
+AWS cloud cartridge for the BoJ server. Provides type-safe access to AWS
+services via Signature V4 authentication, with credentials proxied through
+vault-mcp. Supports S3, EC2, Lambda, SQS, and DynamoDB with configurable
+region and automatic service endpoint routing.
+
+=== State Machine
+
+`Unauthenticated -> Authenticated -> RateLimited -> Authenticated` (normal flow)
+
+`Authenticated -> Error -> Unauthenticated` (error recovery)
+
+=== Actions (16)
+
+[cols="1,1"]
+|===
+| Service | Actions
+
+| S3
+| ListBuckets, GetObject, PutObject, DeleteObject
+
+| EC2
+| ListInstances, StartInstance, StopInstance
+
+| Lambda
+| ListFunctions, InvokeFunction
+
+| SQS
+| ListQueues, SendMessage, ReceiveMessage
+
+| DynamoDB
+| ListTables, PutItem, GetItem, QueryTable
+|===
+
+== Architecture
+
+[cols="1,1,2"]
+|===
+| Layer | Language | Purpose
+
+| ABI
+| Idris2
+| Formally verified state machine with dependent-type proofs (AwsMcp.SafeCloud)
+
+| FFI
+| Zig
+| C-compatible implementation with thread-safe session pool, service routing
+
+| Adapter
+| V-lang
+| REST bridge to BoJ unified adapter protocol
+|===
+
+== Building
+
+[source,bash]
+----
+# Build FFI shared library
+cd ffi && zig build
+
+# Run FFI tests
+cd ffi && zig build test
+
+# Type-check ABI
+cd abi && idris2 --check aws_mcp.ipkg
+----
+
+== Status
+
+Development — customised with AWS-specific state machine, auth, and service routing.