Add L0-L4 security clearance for fleet commands and AI elevation.

Gate manual and AI commands by per-agent clearance, auto-elevate stuck hosts to L4 when AI mode allows, and surface clearance in Access Depth and LOTL timeline.

server/internal/clearance/elevation.go

@@ -0,0 +1,42 @@
+package clearance
+
+import (
+	"fmt"
+	"strings"
+)
+
+// EventStore persists clearance changes and audit rows.
+type EventStore interface {
+	InsertClearanceEvent(agentID string, fromLevel, toLevel int, reason, source string) error
+}
+
+// RequestElevation raises an agent to toLevel when higher than current, logs the event, and returns the new level.
+func RequestElevation(store EventStore, agentID string, currentLevel, toLevel int, reason, source string) (int, error) {
+	agentID = strings.TrimSpace(agentID)
+	if agentID == "" {
+		return currentLevel, fmt.Errorf("agent id required")
+	}
+	if toLevel < L0 {
+		toLevel = L0
+	}
+	if toLevel > L4 {
+		toLevel = L4
+	}
+	if toLevel <= currentLevel {
+		return currentLevel, nil
+	}
+	reason = strings.TrimSpace(reason)
+	if reason == "" {
+		reason = "elevation requested"
+	}
+	source = strings.TrimSpace(source)
+	if source == "" {
+		source = "system"
+	}
+	if store != nil {
+		if err := store.InsertClearanceEvent(agentID, currentLevel, toLevel, reason, source); err != nil {
+			return currentLevel, err
+		}
+	}
+	return toLevel, nil
+}