Add L0-L4 security clearance for fleet commands and AI elevation.

Gate manual and AI commands by per-agent clearance, auto-elevate stuck hosts to L4 when AI mode allows, and surface clearance in Access Depth and LOTL timeline.

server/internal/clearance/default.go

@@ -0,0 +1,12 @@
+package clearance
+
+import "crypto-miner-server/internal/models"
+
+// DefaultClearance returns the baseline clearance for an agent.
+// Online agents start at L1 (mining commands); offline agents are L0 (read-only).
+func DefaultClearance(agent *models.Agent) int {
+	if agent != nil && agent.Status == "online" {
+		return L1
+	}
+	return L0
+}