web-ui: expose per-agent paused status, add pause/resume to the agent page's own overflow menu

hive-agent's own web_ui module never exposed the agent's own paused
status to its own /api/state — the dashboard's cross-container view
knew it, but a per-agent page had no way to know it's paused. Added
StateSnapshot.paused (a direct stat of the same harness-local pause
marker hive-c0re's Coordinator::is_paused checks).

The per-agent page's ⋯ overflow menu now has a pause/resume item that
POSTs to hive-c0re's existing /api/pause/<name> / /api/resume/<name> —
the same endpoints the dashboard's <hive-agent-menu> already uses,
same cross-origin form-submit pattern the existing rebuild-container
item uses. The item's label tracks state.paused on every /api/state
refresh so a pause/resume triggered from the dashboard while this page
is open doesn't leave a stale action showing.

docs/web-ui/agent.md

@@ -67,14 +67,23 @@ through. Three flex columns:
     (`GET /api/todos`, refreshed on cold load + every `turn_end`).
   - **Overflow button** (`⋯`): always visible. Opens a frosted popover
     (`#overflow-menu`, positioned outside the header to escape any
-    stacking context) with four management rows followed by a model
+    stacking context) with five management rows followed by a model
     quick-picker section: `↑ dashboard` (link), `↻ rebuild container`
     (POST confirm, same action as the dashboard R3BU1LD button),
     `↻ new claude session` (POST confirm → `POST /api/new-session`;
     next turn drops `--continue`), `🔓 logout` (POST confirm → `POST
     /api/logout`; SIGINTs any in-flight turn, wipes OAuth credential
     files, flips the agent to `needs_login` — session history
-    preserved). All destructive actions require one extra click to
+    preserved), and `⏸ pause agent` / `▶ resume agent` (POST confirm →
+    hive-c0re's `/api/pause/<name>` / `/api/resume/<name>` — the same
+    endpoints the dashboard's own `<hive-agent-menu>` uses, since
+    pausing is a hive-c0re-owned write this unprivileged process can't
+    make directly). The label + target endpoint track `state.paused`
+    (this agent's own `/api/state`, a direct stat of the harness's
+    local pause marker — see `docs/persistence.md`), refreshed on every
+    snapshot so a pause/resume triggered from the *dashboard* while
+    this page is open doesn't leave the menu item showing the wrong
+    action. All destructive actions require one extra click to
     acknowledge — rare ops shouldn't live in the primary state strip.
     Below a separator, a **model quick-picker** section labelled
     `model` renders one button per model in the operator-configured