feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/api/auth_context.go

@@ -0,0 +1,25 @@
+package api
+
+import (
+	"context"
+	"net/http"
+)
+
+type contextKey string
+
+const authUserKey contextKey = "auth_user"
+
+func withAuthUser(r *http.Request, username string) *http.Request {
+	return r.WithContext(context.WithValue(r.Context(), authUserKey, username))
+}
+
+// AuthUsername returns the Basic-auth username for the current request, if any.
+func AuthUsername(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	if u, ok := r.Context().Value(authUserKey).(string); ok {
+		return u
+	}
+	return ""
+}