feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/camera_common_test.go

@@ -0,0 +1,45 @@
+package client
+
+import "testing"
+
+func TestParseDShowVideoDevices(t *testing.T) {
+	sample := `[dshow @ 000001] DirectShow video devices (some may be both video and audio devices)
+[dshow @ 000001]   "Integrated Camera"
+[dshow @ 000001]     Alternative name "@device_pnp_\\?\usb#..."
+[dshow @ 000001]   "USB Video Device"
+[dshow @ 000001] DirectShow audio devices
+[dshow @ 000001]   "Microphone (USB Video Device)"
+`
+	devs := parseDShowVideoDevices(sample)
+	if len(devs) != 2 {
+		t.Fatalf("got %d devices: %v", len(devs), devs)
+	}
+	if devs[0] != "Integrated Camera" || devs[1] != "USB Video Device" {
+		t.Fatalf("unexpected names: %v", devs)
+	}
+}
+
+func TestExtractQuotedDeviceName(t *testing.T) {
+	if got := extractQuotedDeviceName(`[dshow]   "My Cam"`); got != "My Cam" {
+		t.Fatalf("got %q", got)
+	}
+	if got := extractQuotedDeviceName("no quotes"); got != "" {
+		t.Fatalf("expected empty, got %q", got)
+	}
+}
+
+func TestEncodeCameraSnapshotJPEG(t *testing.T) {
+	jpeg := []byte{0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 'J', 'F', 'I', 'F'}
+	// pad to >= 100 bytes
+	for len(jpeg) < 100 {
+		jpeg = append(jpeg, 0)
+	}
+	b64, err := encodeCameraSnapshotJPEG(jpeg)
+	if err != nil || len(b64) < 100 {
+		t.Fatalf("encode: err=%v len=%d", err, len(b64))
+	}
+	_, err = encodeCameraSnapshotJPEG([]byte{1, 2, 3})
+	if err == nil {
+		t.Fatal("expected error for non-jpeg")
+	}
+}