feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/deploy/autostart_windows_test.go

@@ -0,0 +1,19 @@
+//go:build windows
+
+package deploy
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestUserStartupFolderSuffix(t *testing.T) {
+	dir, err := userStartupFolder()
+	if err != nil {
+		t.Skip("APPDATA unset in test environment")
+	}
+	if !strings.HasSuffix(filepath.ToSlash(dir), "Programs/Startup") {
+		t.Fatalf("unexpected startup dir %q", dir)
+	}
+}