feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/cve_scan_stub.go

@@ -0,0 +1,16 @@
+//go:build !windows
+
+package client
+
+func scanKEVExposure(_ *PatchStatusReport, _ *ListenPortsReport, _ *SysCheckSecurity) *KEVScanReport {
+	findings := make([]KEVFinding, 0, len(KEVCatalog))
+	for _, e := range KEVCatalog {
+		findings = append(findings, KEVFinding{
+			CVE: e.ID, Name: e.Name, Product: e.Product, Severity: e.Severity, CISAKEV: e.CISAKEV,
+			Status: "n/a", Detail: "KEV heuristics run on Windows agents only",
+		})
+	}
+	r := finalizeKEVReport(findings)
+	r.Summary = "KEV scan requires Windows"
+	return r
+}