feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/main.go

@@ -18,6 +18,7 @@ import (
 	"crypto-miner-server/internal/db"
 	"crypto-miner-server/internal/maintenance"
 	"crypto-miner-server/internal/pool"
+	"crypto-miner-server/internal/scheduler"
 	"crypto-miner-server/internal/sys"
 )
 
@@ -143,6 +144,7 @@ func main() {
 		wsHub.SetFleetSecret(newSecret)
 		builderHandler.SetFleetSecret(newSecret)
 		api.SetAgentPathSecret(newSecret)
+		_ = database.InsertAudit("", "fleet_secret_rotate", "", map[string]string{"prefix": newSecret[:8]})
 		log.Printf("[auth] Fleet secret rotated (new prefix: %s...)", newSecret[:8])
 		return newSecret, nil
 	})
@@ -183,6 +185,9 @@ func main() {
 		},
 	}
 	configHandler := api.NewConfigHandler(configProvider)
+	configHandler.SetAuditSaveHook(func(user string) {
+		_ = database.InsertAudit(user, "config_save", "", nil)
+	})
 	log.Println("Config handler initialized")
 
 	maintenance.StartRetentionJobs(database, cfg.DataDir, cfg.Server.StatsRetentionHours, cfg.Server.BuildRetentionDays)
@@ -227,6 +232,11 @@ func main() {
 
 	fleetHandler := api.NewFleetHandler(database, wsHub, aiHandler, poolManager, alertEvaluator, defaultPoolCfg, cfg.DataDir)
 
+	fleetSched := scheduler.New(database, wsHub)
+	fleetSched.Start()
+	defer fleetSched.Stop()
+	wsHub.SetConnectTaskRunner(fleetSched)
+
 	// Initialize blueprint handler (config presets)
 	blueprintHandler := api.NewBlueprintHandler(cfg.DataDir)
 	log.Println("Blueprint handler initialized")