feat(stats): per-container cpu/mem load (#1424 p3)

C0NT41N3R L04D on the SYST3M tab + GET /api/container-resources.

Backend (hive-c0re/src/container_stats.rs): reads cgroup v2 cpu.stat +
memory.{current,peak,max} for each running agent machine
(machine-h\x2d<name>.scope under machine.slice), read-only/world-
readable so no hive-priv. CPU is a two-sample (~200ms) host-normalised
percentage; one shared sleep covers all agents. Skips agents whose
scope dir is absent (= not running). Network omitted: agents share the
host netns, no per-container counter.

Frontend: a polled C0NT41N3R L04D table on SYST3M (agent / cpu / mem /
peak / limit with meter bars), reusing the ST4TS table style. Polls
/api/container-resources every 5s only while the tab is active.

Backend reviewed-in-principle by damocles (path escaping + cpu delta
math); ping for the on-host sign-off.

docs/web-ui/dashboard.md

@@ -153,6 +153,22 @@ age + claude-creds badge). Two actions: `⊕ R3V1V3` (queues a
 Spawn approval; existing state is reused), `PURG3` (wipes
 state + applied dirs; `POST /purge-tombstone/{name}`).
 
+**C0NT41N3R L04D** — live CPU + memory per agent container, read
+straight from cgroup v2 on the host (`cpu.stat`, `memory.current`,
+`memory.peak`, `memory.max` under
+`/sys/fs/cgroup/machine.slice/machine-h\x2d<name>.scope/`). CPU is a
+host-normalised percentage (0..100 across all cores) sampled over a
+short (~200 ms) two-read interval; memory shows current + peak with a
+bar against the `memory.max` quota. Backed by
+`GET /api/container-resources` (`container_stats.rs`), which reads the
+files read-only (world-readable; no `hive-priv`) and skips agents whose
+scope dir is absent (= not running). Pull-only: `tabs.js` polls every
+5 s **only while the SYST3M tab is active** (CPU needs a fresh sample
+each refresh), and stops on tab change. Network is intentionally
+omitted — agents share the host netns, so there is no per-container net
+counter (per-agent network needs the netns-isolation roadmap in
+`docs/network.md`).
+
 ## P3RM1SS10NS tab
 
 Per-agent permission configuration. Two sections, each rendered as a
@@ -838,6 +854,12 @@ that's a browser-level decision, not ours.
   zero-turn dbs); returns swarm totals, a busiest-first per-agent
   rollup, swarm model mix, and a labelled `est_cost_usd`. Window
   defaults to `24h`.
+- `GET /api/container-resources` — live per-agent-container CPU +
+  memory from cgroup v2 (SYST3M › C0NT41N3R L04D panel). Returns one
+  row per running agent (`name`, `cpu_pct`, `mem_current_bytes`,
+  `mem_peak_bytes`, `mem_max_bytes`); samples CPU over ~200 ms so the
+  call briefly awaits. Skips non-running agents (no scope dir). No
+  network field — agents share the host netns.
 - `POST /cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).