Fleet control without SSH drift

Better Auth handles operator access. The agent channel stays isolated and token-based.