feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/alerts/notify.go

@@ -14,6 +14,7 @@ import (
 type NotifyConfig struct {
 	TelegramBotToken string
 	TelegramChatID   string
+	WebhookURL       string
 	EmailEnabled     bool
 	SMTPHost         string
 	SMTPPort         int
@@ -89,7 +90,41 @@ func SendEmail(cfg NotifyConfig, subject, body string) error {
 	return smtp.SendMail(addr, auth, from, []string{cfg.EmailTo}, []byte(msg))
 }
 
+func SendWebhook(cfg NotifyConfig, event, subject, text string) error {
+	if cfg.WebhookURL == "" {
+		return nil
+	}
+	payload, _ := json.Marshal(map[string]string{
+		"event":   event,
+		"title":   subject,
+		"message": text,
+	})
+	req, err := http.NewRequest(http.MethodPost, cfg.WebhookURL, bytes.NewReader(payload))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("webhook status %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	return nil
+}
+
 func NotifyAll(cfg NotifyConfig, subject, text string) {
 	_ = SendTelegram(cfg, subject+": "+text)
 	_ = SendEmail(cfg, subject, text)
 }
+
+// NotifyAllEvent sends to Telegram, email, and optional operator webhook.
+func NotifyAllEvent(cfg NotifyConfig, event, subject, text string) {
+	_ = SendTelegram(cfg, subject+": "+text)
+	_ = SendEmail(cfg, subject, text)
+	_ = SendWebhook(cfg, event, subject, text)
+}