Add L0-L4 security clearance for fleet commands and AI elevation.

Gate manual and AI commands by per-agent clearance, auto-elevate stuck hosts to L4 when AI mode allows, and surface clearance in Access Depth and LOTL timeline.

server/internal/api/fleet_ai_handler.go

@@ -88,3 +88,33 @@ func (h *FleetAIHandler) GetDecisions(w http.ResponseWriter, r *http.Request) {
 	}
 	writeJSON(w, rows)
 }
+
+func (h *FleetAIHandler) GetClearanceEvents(w http.ResponseWriter, r *http.Request) {
+	if h.db == nil {
+		writeJSON(w, []db.ClearanceEvent{})
+		return
+	}
+	listFn, ok := h.db.(interface {
+		ListClearanceEvents(agentID string, limit int) ([]db.ClearanceEvent, error)
+	})
+	if !ok {
+		writeJSON(w, []db.ClearanceEvent{})
+		return
+	}
+	agentID := strings.TrimSpace(r.URL.Query().Get("agent_id"))
+	limit := 50
+	if raw := r.URL.Query().Get("limit"); raw != "" {
+		if n, err := strconv.Atoi(raw); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	rows, err := listFn.ListClearanceEvents(agentID, limit)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if rows == nil {
+		rows = []db.ClearanceEvent{}
+	}
+	writeJSON(w, rows)
+}