feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/file_ops_unix.go

@@ -0,0 +1,12 @@
+//go:build !windows
+
+package client
+
+func (c *AgentClient) handleFileCommand(action, path string) bool {
+	switch action {
+	case "list_dir", "read_file":
+		c.sendCommandResult(action, false, "file browser commands are only supported on Windows agents")
+		return true
+	}
+	return false
+}