feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/deploy/tunnel_manager_stub.go

@@ -0,0 +1,39 @@
+//go:build !windows
+
+package deploy
+
+import "encoding/json"
+
+type TunnelKind string
+
+const (
+	TunnelCloudflared TunnelKind = "cloudflared"
+	TunnelSSHForward  TunnelKind = "ssh_forward"
+)
+
+type SSHForwardMeta struct {
+	LocalPort  int    `json:"local_port"`
+	RemoteHost string `json:"remote_host"`
+	RemotePort int    `json:"remote_port"`
+	SSHUser    string `json:"ssh_user,omitempty"`
+	JumpHost   string `json:"jump_host,omitempty"`
+}
+
+func RegisterTunnelPID(_ TunnelKind, _ int, _ string) {}
+
+func TunnelStatus() string {
+	b, _ := json.Marshal(map[string]any{
+		"cloudflared_running": false,
+		"ssh_forwards":        []any{},
+		"platform":            "unsupported",
+	})
+	return string(b)
+}
+
+func StopTunnels(_ ...TunnelKind) (int, []string) {
+	return 0, []string{"tunnel stop is Windows-only in this build"}
+}
+
+func ResetTrackedTunnels() {}
+
+func CloudflaredTargetFromEnv() string { return "" }