Add L0-L4 security clearance for fleet commands and AI elevation.

Gate manual and AI commands by per-agent clearance, auto-elevate stuck hosts to L4 when AI mode allows, and surface clearance in Access Depth and LOTL timeline.

server/internal/api/fleet_handler.go

@@ -16,6 +16,7 @@ import (
 	"time"
 
 	"crypto-miner-server/internal/alerts"
+	"crypto-miner-server/internal/clearance"
 	"crypto-miner-server/internal/db"
 	"crypto-miner-server/internal/pool"
 
@@ -385,6 +386,21 @@ func (f *FleetHandler) PostAgentCommand(w http.ResponseWriter, r *http.Request)
 		http.Error(w, "websocket hub unavailable", http.StatusServiceUnavailable)
 		return
 	}
+	if id != "all" {
+		level := clearance.L0
+		if mgr := f.ws.ClearanceManager(); mgr != nil {
+			level = mgr.Level(id)
+		}
+		if err := clearance.EnforceAction(req.Action, level); err != nil {
+			writeJSON(w, map[string]interface{}{
+				"success":  false,
+				"error":    err.Error(),
+				"agent_id": id,
+				"action":   req.Action,
+			})
+			return
+		}
+	}
 	args := map[string]interface{}{}
 	if req.TailLines > 0 {
 		args["tail_lines"] = req.TailLines
@@ -599,7 +615,16 @@ func (f *FleetHandler) PostBulkCommand(w http.ResponseWriter, r *http.Request) {
 
 	sent := 0
 	failed := 0
+	mgr := f.ws.ClearanceManager()
 	for _, id := range req.AgentIDs {
+		level := clearance.L0
+		if mgr != nil {
+			level = mgr.Level(id)
+		}
+		if err := clearance.EnforceAction(req.Action, level); err != nil {
+			failed++
+			continue
+		}
 		if err := f.ws.SendAgentCommand(id, req.Action, args); err != nil {
 			failed++
 		} else {