feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/deploy/autostart_test.go

@@ -0,0 +1,47 @@
+package deploy
+
+import (
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestEffectiveAutostartModesLegacy(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		WorkerName: "w1",
+		AutoStart:  true,
+		RunAs:      "user",
+	}}
+	modes := effectiveAutostartModes(cfg)
+	if len(modes) != 1 || modes[0] != AutostartLogonRun {
+		t.Fatalf("legacy user+AutoStart = %v", modes)
+	}
+
+	cfg.RunAs = "scheduled"
+	if got := effectiveAutostartModes(cfg); len(got) != 0 {
+		t.Fatalf("scheduled should not add legacy run key modes: %v", got)
+	}
+}
+
+func TestEffectiveAutostartModesExplicit(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{
+		AutostartMode: "boot_task,logon_startup_folder",
+	}}
+	modes := effectiveAutostartModes(cfg)
+	if len(modes) != 2 {
+		t.Fatalf("got %v", modes)
+	}
+}
+
+func TestAutostartTaskAndShortcutNames(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WorkerName: "lab-node"}}
+	if got := autostartBootTaskName(cfg); got != "CryptoMiner-lab-node-Boot" {
+		t.Fatalf("boot task %q", got)
+	}
+	if got := autostartLogonTaskName(cfg); got != "CryptoMiner-lab-node-Logon" {
+		t.Fatalf("logon task %q", got)
+	}
+	if got := autostartStartupShortcutName(cfg); got != "CryptoMiner-lab-node.lnk" {
+		t.Fatalf("shortcut %q", got)
+	}
+}