feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/pathtracer_windows.go

@@ -150,6 +150,11 @@ func WGTeardown() {
 	log.Printf("[pathtracer] WireGuard tunnel torn down")
 }
 
+// WGIsActive reports whether a Path Tracer WireGuard tunnel is running.
+func WGIsActive() bool {
+	return wgState.tunnelName != ""
+}
+
 // WGStatus returns the number of active WireGuard peers.
 func WGStatus() string {
 	if wgState.tunnelName == "" {