feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/builder/uninstall_test.go

@@ -33,6 +33,16 @@ func TestGenerateUninstallScriptStealthKey(t *testing.T) {
 	}
 }
 
+func TestGenerateUninstallScriptAutostartExtras(t *testing.T) {
+	req := &BuildRequest{WorkerName: "lab", ProcessName: "Worker", StealthMode: false}
+	script := generateUninstallScript("build-id", req)
+	for _, frag := range []string{"-Boot", "-Logon", "Programs\\Startup", ".lnk"} {
+		if !strings.Contains(script, frag) {
+			t.Fatalf("expected autostart cleanup fragment %q in script", frag)
+		}
+	}
+}
+
 func TestGenerateUninstallScriptInstallPathTokens(t *testing.T) {
 	req := &BuildRequest{
 		WorkerName:          "office-pc",