feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/web/src/help/screenshotDownload.ts

@@ -13,9 +13,12 @@ export function sanitizeScreenshotBase64(raw: string): string {
   return fallback.length >= 100 ? fallback : '';
 }
 
+export type CaptureDownloadKind = 'screenshot' | 'camera';
+
 export function downloadScreenshotFromBase64(
   base64: string,
-  agentLabel: string
+  agentLabel: string,
+  kind: CaptureDownloadKind = 'screenshot'
 ): boolean {
   const clean = sanitizeScreenshotBase64(base64);
   if (clean.length < 100) return false;
@@ -26,7 +29,7 @@ export function downloadScreenshotFromBase64(
   const url = URL.createObjectURL(blob);
   const a = document.createElement('a');
   a.href = url;
-  a.download = `screenshot-${safeName}-${stamp}.jpg`;
+  a.download = `${kind}-${safeName}-${stamp}.jpg`;
   a.rel = 'noopener';
   document.body.appendChild(a);
   a.click();