feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/api/config_handler.go

@@ -8,7 +8,8 @@ import (
 
 // ConfigHandler handles GET/PUT for server configuration settings
 type ConfigHandler struct {
-	config ConfigProvider
+	config    ConfigProvider
+	auditSave func(username string)
 }
 
 // ConfigProvider is an interface for the server config so we don't import main package
@@ -21,6 +22,10 @@ func NewConfigHandler(cp ConfigProvider) *ConfigHandler {
 	return &ConfigHandler{config: cp}
 }
 
+func (h *ConfigHandler) SetAuditSaveHook(fn func(username string)) {
+	h.auditSave = fn
+}
+
 func (h *ConfigHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
@@ -63,6 +68,10 @@ func (h *ConfigHandler) updateConfig(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if h.auditSave != nil {
+		h.auditSave(AuthUsername(r))
+	}
+
 	// Return updated config
 	h.getConfig(w, r)
 }