apply each agent's internet flag to its squid credential

docs/networking/network.md

@@ -230,17 +230,33 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   store and the next pass mints a new one. HTTP Basic crosses the bridge in
   clear between an agent and the proxy. See
   [the credentials reference](../swarm/credentials-reference.md).
-  A name that isn't on the allow-list gets the 403 whether or not the request
-  has a credential; a listed name without one gets a 407.
+  A request without a valid credential gets a 407, once the destination
+  checks below have passed it.
+
+- **Two lists.** The credential decides the policy. `hive-c0re` writes a
+  second file beside the users file, `services.hyperhive.squid.unrestrictedFile`
+  (`/var/lib/hive-squid/unrestricted`, `hive-core:squid`, `0640`): the names of
+  the users whose agent holds the `unrestricted_internet` flag in the
+  permissions the hive last read from the swarm, one per line, rewritten when
+  it changes. An agent with no record, or a record that never set the flag,
+  holds it, the same default as the
+  `hyperhive.agent.unrestricted_internet` metric. Squid reads the list when it
+  parses its configuration, so `squid-unrestricted-reload.path` reloads squid
+  when the file changes. A missing or empty file lists no one, and squid
+  starts either way. A flag change reaches squid after the hive's next read of
+  the permissions and its next 30-second pass.
 
 - **Allow-list.** `services.hyperhive.squid.allowedDomains` defaults to the
   swarm's own service names (`services.hyperhive.swarm.serviceDomains`). Each
-  entry matches that exact name. Everything else gets a 403.
-- **Unlisted names.** Refused first, without a DNS lookup.
+  entry matches that exact name. A user on the unrestricted list reaches any
+  other name too, on ports 80 and 443. Everyone else gets a 403 for it.
+- **Unlisted names.** For a user who isn't on the unrestricted list, refused
+  after the destination checks, which look the name up on the host.
 - **Denied before any allow.** Destinations that resolve to loopback,
-  link-local or the bridge subnet, and IP-literal hosts. Squid resolves names
-  on the host, so without these a listed name pointing at `127.0.0.1` would
-  walk around the bridge→loopback DROP rule. Only `CONNECT` to port 443 and
+  link-local or the bridge subnet, and IP-literal hosts, for every user
+  including the unrestricted ones. Squid resolves names on the host, so
+  without these a name pointing at `127.0.0.1` would walk around the
+  bridge→loopback DROP rule. Only `CONNECT` to port 443 and
   plain HTTP to ports 80 and 443 pass.
 - **Metrics.** `squid-exporter` serves `prometheus-squid-exporter` on
   `127.0.0.1:9301`. The hive collector scrapes it as job `squid` through
@@ -254,9 +270,13 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   every minute from the bridge IP, logging in as `selfcheck.squid`: `CONNECT`
   to `services.hyperhive.squid.selfcheck.canary` (default: the forge's name)
   must answer 200, to `deny-canary.invalid` 403, and to the canary without a
-  credential 407. It writes one `squid-selfcheck ok=… allow_status=…
-deny_status=… anon_status=… credential=present|absent` line per run and
-  fails the unit when any is wrong. The password is the hive's
+  credential 407. It then logs in as `selfcheck-unrestricted.squid`, which has
+  the same secret and is always on the unrestricted list, and a `CONNECT` to
+  `services.hyperhive.squid.selfcheck.unrestrictedCanary` (default:
+  `example.com`, a name outside the allow-list) must answer 200. It writes one
+  `squid-selfcheck ok=… allow_status=… deny_status=… anon_status=…
+credential=present|absent unrestricted_canary=… unrestricted_status=…` line
+  per run and fails the unit when any is wrong. The password is the hive's
   `swarm/hives/<hive>/squid-selfcheck` secret, which
   `squid-selfcheck-credential` lands at `/run/credstore/hive-squid.selfcheck`.
   Before `swarm-controller` has minted it, or while `hive-c0re` hasn't