feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/alerts/evaluator.go

@@ -182,7 +182,7 @@ func (e *Evaluator) fire(ev AlertEvent, cooldownKey string) {
 	log.Printf("[Alert] %s: %s", ev.Type, ev.Message)
 	s := e.settings()
 	if s.EnabledForAlertType(ev.Type) {
-		NotifyAll(s.NotifyConfig, "AetherForge "+ev.Type, ev.Message)
+		NotifyAllEvent(s.NotifyConfig, ev.Type, "AetherForge "+ev.Type, ev.Message)
 	}
 	if e.broadcast != nil {
 		e.broadcast(ev)