feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/cve_scan_common.go

@@ -0,0 +1,34 @@
+package client
+
+import "time"
+
+func finalizeKEVReport(findings []KEVFinding) *KEVScanReport {
+	r := &KEVScanReport{
+		ScannedAt: time.Now().UTC().Format(time.RFC3339),
+		Findings:  findings,
+	}
+	for _, f := range findings {
+		switch f.Status {
+		case "exposed":
+			r.ExposedCount++
+			if f.Severity == "critical" {
+				r.CriticalCount++
+			}
+		case "likely":
+			r.LikelyCount++
+		}
+	}
+	r.RiskScore = kevRiskScore(r)
+	return r
+}
+
+func kevRiskScore(r *KEVScanReport) int {
+	if r == nil {
+		return 0
+	}
+	score := r.CriticalCount*25 + r.ExposedCount*15 + r.LikelyCount*8
+	if score > 100 {
+		return 100
+	}
+	return score
+}