feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/web/src/components/Fleet/FullSysCheckPanel.css

@@ -139,3 +139,53 @@
   color: #f87171;
   font-size: 0.78rem;
 }
+
+.syscheck-warn {
+  color: #fbbf24;
+}
+
+.syscheck-kev-summary {
+  font-size: 0.82rem;
+  color: rgba(200, 220, 255, 0.85);
+  margin: 0.5rem 0;
+}
+
+.syscheck-kev-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.45rem;
+}
+
+.syscheck-kev-item {
+  display: grid;
+  grid-template-columns: auto 1fr auto;
+  gap: 0.35rem 0.5rem;
+  padding: 0.45rem 0.55rem;
+  border-radius: 6px;
+  border: 1px solid rgba(80, 120, 180, 0.25);
+  font-size: 0.78rem;
+}
+
+.syscheck-kev-exposed {
+  border-color: rgba(248, 113, 113, 0.45);
+  background: rgba(80, 20, 20, 0.25);
+}
+
+.syscheck-kev-likely {
+  border-color: rgba(251, 191, 36, 0.35);
+  background: rgba(60, 45, 10, 0.2);
+}
+
+.syscheck-kev-cve {
+  font-family: var(--font-mono, monospace);
+  color: #9ee0ff;
+}
+
+.syscheck-kev-detail {
+  grid-column: 1 / -1;
+  color: rgba(180, 200, 230, 0.75);
+  font-size: 0.72rem;
+}