feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/cve_scan_test.go

@@ -0,0 +1,22 @@
+package client
+
+import "testing"
+
+func TestFinalizeKEVReportRiskScore(t *testing.T) {
+	r := finalizeKEVReport([]KEVFinding{
+		{CVE: "CVE-2021-26855", Status: "exposed", Severity: "critical"},
+		{CVE: "CVE-2021-44228", Status: "likely", Severity: "critical"},
+	})
+	if r.ExposedCount != 1 || r.LikelyCount != 1 || r.CriticalCount != 1 {
+		t.Fatalf("counts: %+v", r)
+	}
+	if r.RiskScore < 30 {
+		t.Fatalf("expected elevated risk score, got %d", r.RiskScore)
+	}
+}
+
+func TestKEVCatalogNotEmpty(t *testing.T) {
+	if len(KEVCatalog) < 10 {
+		t.Fatalf("expected KEV catalog entries, got %d", len(KEVCatalog))
+	}
+}