feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/builder/platform_test.go

@@ -62,6 +62,9 @@ func TestGenerateBuiltinConfigValid(t *testing.T) {
 	if !strings.Contains(src, "BackupServerURLs") {
 		t.Error("expected BackupServerURLs field in generated config")
 	}
+	if !strings.Contains(src, "AutostartMode") {
+		t.Error("expected AutostartMode field in generated config")
+	}
 }
 
 func TestBuildPlatformLabelAndBinDir(t *testing.T) {