feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/models/audit.go

@@ -0,0 +1,15 @@
+package models
+
+import (
+	"encoding/json"
+	"time"
+)
+
+type AuditEntry struct {
+	ID        int64           `json:"id"`
+	Timestamp time.Time       `json:"timestamp"`
+	Username  string          `json:"username"`
+	Action    string          `json:"action"`
+	AgentID   string          `json:"agent_id,omitempty"`
+	Detail    json.RawMessage `json:"detail,omitempty"`
+}