feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/syscheck.go

@@ -61,6 +61,8 @@ func CollectFullSysCheck(cfg config.RuntimeConfig, agentID string) *FullSysCheck
 
 	collectSysCheckPlatform(r)
 
+	r.KEVExposure = scanKEVExposure(r.Patch, r.ListenPorts, r.Security)
+
 	if dir, err := cfg.InstallDirectory(); err == nil {
 		if r.Environment == nil {
 			r.Environment = &SysCheckEnvironment{}