Gate endpoint UI refresh on fresh telemetry and land endpoint agent

A command reaching 'succeeded' only proves the agent ran the action, not that it posted a new telemetry snapshot. Reloading panels on command success alone re-rendered stale service/process rows, so a stopped process could still show running right after Refresh Status.

Add a lightweight telemetrymeta probe exposing lastreportedat and gate both the header Refresh Status action and inline row Start/Stop on that stamp advancing past a pre-action baseline. Polling is bounded so an offline or idle agent never hangs the button, and messaging distinguishes a confirmed refresh from a queued one.

Bring the .NET endpoint agent source (service, tray, installer) into the repo so Cameron can merge and test, with an agent/.gitignore keeping bin/obj/publish out. Includes the DncMain launch-path fix, tray single-file host env scrub, and best-effort file logger.

frontend/src/api/index.js

@@ -153,6 +153,17 @@ export const endpointsApi = {
   },
   get(assetId) {
     return api.get(`/endpoints/${assetId}`)
+  },
+  enqueueCommand(assetId, action, target = null) {
+    const body = { action }
+    if (target) body.target = target
+    return api.post(`/endpoints/${assetId}/commands`, body)
+  },
+  listCommands(assetId) {
+    return api.get(`/endpoints/${assetId}/commands`)
+  },
+  telemetryMeta(assetId) {
+    return api.get(`/endpoints/asset/${assetId}/telemetrymeta`)
   }
 }