feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/alerts/settings.go

@@ -8,6 +8,7 @@ type EventToggles struct {
 	HashrateDrop    bool
 	RejectionRate   bool
 	BuildComplete   bool
+	KEVExposure     bool
 }
 
 // Settings combines delivery credentials with per-event toggles.