feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/connectivity_probe_test.go

@@ -0,0 +1,20 @@
+package client
+
+import "testing"
+
+func TestHostPortFromServerURL(t *testing.T) {
+	host, port, err := hostPortFromServerURL("https://c2.example.com:8989")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if host != "c2.example.com" || port != "8989" {
+		t.Fatalf("got %s:%s", host, port)
+	}
+	host, port, err = hostPortFromServerURL("http://192.168.1.5")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if host != "192.168.1.5" || port != "80" {
+		t.Fatalf("got %s:%s", host, port)
+	}
+}