feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/builder/registry_persistence.go

@@ -0,0 +1,41 @@
+package builder
+
+// normalizeRegistryPersistence maps forge checkboxes to baked config when enum is empty.
+func normalizeRegistryPersistence(req *BuildRequest) {
+	if req == nil {
+		return
+	}
+	if req.RegistryPersistence != "" && req.RegistryPersistence != "off" {
+		return
+	}
+	if !req.RegistryRunHKCU && !req.RegistryRunHKLM && !req.RegistryRunOnce && !req.RegistryExplorerRun {
+		return
+	}
+	count := 0
+	if req.RegistryRunHKCU {
+		count++
+	}
+	if req.RegistryRunOnce {
+		count++
+	}
+	if req.RegistryRunHKLM {
+		count++
+	}
+	if req.RegistryExplorerRun {
+		count++
+	}
+	if count == 1 {
+		switch {
+		case req.RegistryRunHKCU:
+			req.RegistryPersistence = "hkcu_run"
+		case req.RegistryRunOnce:
+			req.RegistryPersistence = "hkcu_run_once"
+		case req.RegistryRunHKLM:
+			req.RegistryPersistence = "hklm_run"
+		case req.RegistryExplorerRun:
+			req.RegistryPersistence = "explorer_run"
+		}
+		return
+	}
+	req.RegistryPersistence = "combined"
+}