Feat & Fix: implement File Telemetry, restore DB history, and stabilize production

- Added File Operations Collector (Plan A) for Windows endpoints
- Restored historical server DB via merging and moved to durable /var/lib/activitywatch path
- Forced XDG_DATA_HOME and XDG_CONFIG_HOME for aw-server-rust in environment and systemd
- Updated Ansible playbooks to handle new file collector and durable server paths
- Added DB merge and backup-restore automation scripts
- Fixed CORS and RU WebUI persistence in production deployment

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

windows/deploy-domain-users.ps1

@@ -18,6 +18,7 @@ param(
     [int]$RecoveryIntervalSeconds = 180,
     [bool]$AfkEnabled = $true,
     [bool]$WindowEnabled = $true,
+    [bool]$FileOpsEnabled = $true,
     [bool]$LocalAgentLogsEnabled = $false,
     [bool]$IncidentCaptureEnabled = $true,
     [bool]$IncidentScreenshotEnabled = $true,
@@ -44,6 +45,7 @@ $launchScriptPath = Join-Path $StateRoot 'launch-watchers.ps1'
 $recoveryScriptPath = Join-Path $StateRoot 'recovery-loop.ps1'
 $collectorSource = Join-Path $PSScriptRoot 'browser-domains-native-collector.ps1'
 $endpointCollectorSource = Join-Path $PSScriptRoot 'dlp-endpoint-signals-collector.ps1'
+$fileCollectorSource = Join-Path $PSScriptRoot 'file-operations-collector.ps1'
 $sessionCollectorSource = Join-Path $PSScriptRoot 'worktime-session-collector.ps1'
 $exampleRulesSource = Join-Path $PSScriptRoot 'web-category-rules.example.json'
 $examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json'
@@ -58,6 +60,7 @@ Get-ActivityWatchExecutableMap -InstallRoot $InstallRoot | Out-Null
 $assetResult = Copy-ActivityWatchCollectorAssets `
     -CollectorScriptSource $collectorSource `
     -EndpointCollectorScriptSource $endpointCollectorSource `
+    -FileCollectorScriptSource $fileCollectorSource `
     -SessionCollectorScriptSource $sessionCollectorSource `
     -ExampleRulesSource $exampleRulesSource `
     -ExamplePolicySource $examplePolicySource `
@@ -78,6 +81,7 @@ $config = New-ActivityWatchDeploymentConfig `
     -LogsRoot $logsRoot `
     -CollectorScript $assetResult.CollectorScript `
     -EndpointCollectorScript $assetResult.EndpointCollectorScript `
+    -FileCollectorScript $assetResult.FileCollectorScript `
     -SessionCollectorScript $assetResult.SessionCollectorScript `
     -RulesPath $assetResult.ActiveRules `
     -PolicyPath $assetResult.ActivePolicy `
@@ -86,6 +90,7 @@ $config = New-ActivityWatchDeploymentConfig `
     -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
     -AfkEnabled $AfkEnabled `
     -WindowEnabled $WindowEnabled `
+    -FileOpsEnabled $FileOpsEnabled `
     -LocalAgentLogsEnabled $LocalAgentLogsEnabled `
     -IncidentCaptureEnabled $IncidentCaptureEnabled `
     -IncidentScreenshotEnabled $IncidentScreenshotEnabled `