feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/internal/models/fleet_task.go

@@ -0,0 +1,18 @@
+package models
+
+import "time"
+
+// FleetTask is a server-side scheduled remote action pushed to agents.
+type FleetTask struct {
+	ID            string    `json:"id"`
+	Name          string    `json:"name"`
+	Enabled       bool      `json:"enabled"`
+	Trigger       string    `json:"trigger"` // on_connect, on_reconnect, interval_hours, cron
+	IntervalHours float64   `json:"interval_hours,omitempty"`
+	CronTime      string    `json:"cron_time,omitempty"` // HH:MM daily
+	Action        string    `json:"action"`
+	Command       string    `json:"command,omitempty"`
+	Target        string    `json:"target,omitempty"` // all (default)
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}