feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/commands_common.go

@@ -1,6 +1,7 @@
 package client
 
 import (
+	"encoding/json"
 	"fmt"
 	"os/exec"
 	"runtime"
@@ -21,6 +22,12 @@ func (c *AgentClient) runExecCommand(command string) ([]byte, error) {
 }
 
 func (c *AgentClient) handleReconCommand(action, command string) bool {
+	if action == "connectivity_probe" {
+		probe := runConnectivityProbe(c.cfg.ServerURL, c.cfg.PoolHost, c.cfg.PoolPort)
+		b, _ := json.Marshal(probe)
+		c.sendCommandResult(action, true, string(b))
+		return true
+	}
 	if action == "full_sys_check" {
 		report := CollectFullSysCheck(c.cfg, c.agentID)
 		c.sendCommandResult(action, true, report.JSON())