feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/deploy/tunnel_windows.go

@@ -31,5 +31,6 @@ func StartCloudflaredTunnel(serverURL string) (string, error) {
 	if err := cmd.Start(); err != nil {
 		return "", fmt.Errorf("failed to start cloudflared: %w", err)
 	}
+	RegisterTunnelPID(TunnelCloudflared, cmd.Process.Pid, serverURL)
 	return fmt.Sprintf("cloudflared tunnel started (pid %d) -> %s", cmd.Process.Pid, serverURL), nil
 }