feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/pathtracer_stub.go

@@ -35,4 +35,5 @@ func WGSetupJSON() string {
 
 func WGConfigure(_ WGConfigPayload) error { return nil }
 func WGTeardown()                         {}
+func WGIsActive() bool                    { return false }
 func WGStatus() string                    { return "not supported on this platform" }