remove the 1NFR4 dashboard panel and the now-writer-less audit log

docs/web-ui/dashboard.md

@@ -106,7 +106,7 @@ Passive / rare-interaction state. No longer a dashboard tab — it's a
 standalone page reached from the **Core** tile on the H0M3 hub (served at
 `/core.html`), with the same minimal chrome as `/logs.html`: a `← home`
 back-link + a `createTabStrip` sub-tab nav (**K3PT ST4T3** default,
-then **C0NT41N3R L04D**, then **1NFR4**). The page is its own esbuild bundle (`core.js`)
+then **C0NT41N3R L04D**). The page is its own esbuild bundle (`core.js`)
 that cold-loads `/api/state` and subscribes to `/api/dashboard/stream` for
 `tombstones_changed`, `capabilities_changed`, and `tool_groups_changed`
 (the latter two re-render the stale-perms sub-section when permission
@@ -159,20 +159,10 @@ omitted — agents share the host netns, so there is no per-container net
 counter (per-agent network needs the netns-isolation roadmap in
 `docs/network.md`).
 
-**1NFR4** — start / stop the four hive infrastructure services (`hive-ci`,
-`hive-forge`, `hive-gateway`, `hive-matrix`) directly from the dashboard —
-operator-only, no agent-facing equivalent. One row per service: name, a
-`badge-ok`/`badge-fail` running/stopped dot, and `■ ST0P` (running) or
-`▶ ST4RT` (stopped) buttons, same themed-confirm pattern as the K3PT ST4T3
-tombstone actions. Backed by `POST /api/infra-container/{name}/{action}`
-(`action` ∈ `start|stop`), which calls `priv_client::control_infra_container`
-— no capability check (the dashboard is already operator-authenticated).
-Every attempt is written to the audit log (actor `"operator"`, action
-`start_infra`/`stop_infra`). Status rows ride the `infra_containers` field
-on `GET /api/state`'s `StateSnapshot` (`{name, running}`, live
-`systemctl is-active container@<unit>.service` read); `core.js` polls
-`/api/state` every 5 s only while the 1NFR4 sub-tab is active, same
-cadence/lifecycle as C0NT41N3R L04D's polling.
+Hive infrastructure services (`hive-ci`, `hive-forge`, `hive-gateway`,
+`hive-matrix`) have no dashboard panel — `hivectl stop`/`start`/`restart`
+is the only control surface, a separate host-admin-socket path with no
+HTTP route and no agent-facing equivalent.
 
 ## BU1LDS page (`/builds.html`)
 
@@ -722,7 +712,7 @@ navigation.
 A dedicated log-viewer page (not a tab pane — a separate HTML page),
 reachable from the Logs tile on the H0M3 hub. Minimal chrome:
 a `← home` back link and a three-item sub-tab strip. Tab
-routing is hash-based (`#agent`, `#system`, `#audit`); default is
+routing is hash-based (`#agent`, `#infra`, `#system`); default is
 `#agent`. (Build log history has moved to the BU1LDS page — see above.)
 
 **AGENT sub-tab** — per-container journald viewer. Two selects: agent
@@ -738,6 +728,16 @@ deep-link directly to a specific agent's journal. A "fetched N ago"
 chip appears after the `↻ refresh` button following each successful
 fetch and ticks every 30 s.
 
+**INFRA sub-tab** — journald viewer for the four hive infrastructure
+containers (`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`), a
+fixed client-side list (`INFRA_NAMES` in `logs.js` — no dashboard API
+exposes just the name list). No unit filter (infra containers don't run
+the per-agent hive daemons) — always the full machine journal (or, for
+the gateway, the host journal filtered to its own unit). Fetches
+`GET /api/journal/{name}?lines=500`, same "fetched N ago" ticker as
+AGENT. A `?agent=<name>` deep-link routes here instead of AGENT when
+the name is one of the four infra containers.
+
 **SYSTEM sub-tab** — host-side service logs. Unit selector
 (`hive-c0re.service` / `hive-priv.service`). Fetches
 `GET /api/journal-host?unit=<unit>&lines=500` on activation
@@ -746,27 +746,6 @@ chip ticks every 30 s. Available to the operator unconditionally (not
 capability-gated — the endpoint lives on the hive-c0re dashboard,
 behind the gateway).
 
-**AUDIT sub-tab** — operator-visible trail of privileged actions worth a
-durable who/what/when record (currently: infra-container start/stop from
-the 1NFR4 panel — see `hive-c0re/src/stores/audit_log.rs`'s doc comment
-for what's in scope). Lazy-fetched on tab show (like SYSTEM) from
-`GET /api/audit-log`, which returns `{ entries, total }` — `entries`
-newest-first, server-clamped to the latest 500; `total` drives a "latest
-500 of N" count so the clamp is never silent. Rendered as a filterable
-table (when / agent / action / target / outcome / detail); the filter box
-is a client-side substring match over the cached rows. The outcome badge
-colours `ok` green and `err` red, with an `err` whose `detail` starts
-`denied:` (a capability refusal) shown amber and labelled `denied` so it
-reads apart from an execution failure — generic styling for whichever
-future privileged action writes that prefix, nothing currently produces
-it. `ts_unix` is an RFC 3339 string; a 30 s ticker keeps the
-relative "ago" column honest while the tab is in view. The backing
-`audit_log` store records every privileged-action attempt (ok / err /
-denied). New entries live-append without a refresh: an `audit_entry_added`
-event on `/api/dashboard/stream` (the flattened row) is prepended to the table
-and the "latest N of M" count bumped, de-duped by id against the cold
-fetch.
-
 ## Container row
 
 A full-height **square agent icon** (5em, capped) on the left. The
@@ -1203,12 +1182,6 @@ below — some endpoints aren't in it yet.
   build logs.
 - `GET /api/journal/{name}?unit=&lines=` — journalctl viewer for
   a managed container; rendered in the side panel.
-- `GET /api/audit-log` — agent-initiated privileged-action audit
-  trail. Returns `{ entries, total }`: `entries` is a `Vec<AuditEntry>`
-  (`id`, `ts_unix` as RFC 3339, `agent`, `action`, `target`, `outcome`
-  `"ok"`/`"err"`, `detail` nullable), newest first, server-clamped to
-  500; `total` is the full row count for a "latest 500 of N" header.
-  Backs the LOGS page AUDIT sub-tab.
 - `GET /static/marked.js` serves the vendored `marked` bundle used
   for markdown previews.
 - `GET /api/state-file?path=<host-or-container-path>` — bounded
@@ -1249,14 +1222,6 @@ below — some endpoints aren't in it yet.
   a background `du -sxb` of the agent's state dir + container writable
   rootfs every ~5 min, `-x` excluding the shared read-only nix store.
   `null` until the first sample lands.
-- `POST /api/infra-container/{name}/{action}` — start / stop a hive infra
-  service (C0R3 › 1NFR4 panel, operator-only). `name` parses into the
-  `InfraContainer` allowlist (`hive-ci`/`hive-forge`/`hive-gateway`/
-  `hive-matrix`, 400 on unknown), and the variant decides the unit —
-  `container@<name>.service`, or `nginx.service` for the gateway.
-  `action` ∈ `start|stop`. Calls `priv_client::control_infra_container`;
-  records an `audit_log` entry (`start_infra`/`stop_infra`, actor
-  `"operator"`) either way.
 - `POST /api/cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /api/retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).
@@ -1422,10 +1387,6 @@ payload):
 - `meta_update_running` (running: bool) — emitted when a
   `nix flake update` ripple starts or completes. BU1LDS M3T4 1NPUTS
   tab uses this to show/hide the "⏳ meta-update running" banner.
-- `audit_entry_added` (flattened `AuditEntry` fields: id, ts_unix,
-  agent, action, target, outcome, detail) — a single new audit-log
-  row. L0GS AUDIT sub-tab live-prepends the row and bumps the
-  "latest N of M" count, de-duped by id against the cold fetch.
 
 `/api/state` is **only fetched on cold-load and on the few
 forms that mutate non-event-derived state** (PURG3 +