model: runtime override via /model slash; fixes for port + bind

- runtime model override: Bus::{model,set_model} + POST /api/model
  (form-encoded {model: name}). turn.rs reads bus.model() per turn
  so a flip lands on the next claude invocation. /api/state grows
  a model field; agent page shows a 'model · <name>' chip in the
  state row. '/model <name>' slash command POSTs to the endpoint
  and refreshes state.

- port regression fix: agent_web_port no longer probes forward for
  *existing* agents (the previous fix shifted ports for any agent
  without a port file, including legacy ones whose container was
  already bound to the bare hashed port — dashboard rendered the
  new port, container was still on the old one, conn errors). new
  rule: port file exists → use it; absent + applied flake present
  → legacy, persist port_hash without probing; absent + no applied
  flake → fresh spawn, probe forward.

- SO_REUSEADDR on both the dashboard and per-agent web UI binds
  via tokio::net::TcpSocket. operator hit 12 retries failing on
  manager :8000 — REUSEADDR handles the TIME_WAIT case cleanly
  without a new dep; retry still covers the genuine
  process-still-alive overlap.

todo: drops the model-override entry (shipped); adds two new
items — model persistence (optional, future), and custom
per-agent MCP tools (groundwork for moving bitburner-agent into
hyperhive).

TODO.md

@@ -16,14 +16,29 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   claude-code's `--allowedTools` extended grammar. Likely lives in
   `agent.nix` so each agent can scope its own shell surface.
 
+## Per-agent extension
+
+- **Custom per-agent MCP tools.** Today every sub-agent gets the
+  same fixed MCP surface (`send`, `recv`). To move bitburner-agent
+  (and anything else with rich domain tooling) into hyperhive, an
+  agent needs a way to ship its own tools alongside hyperhive's.
+  Sketch: `agent.nix` declares a list of extra MCP servers
+  (command + args + env), each registered into the agent's
+  `--mcp-config` blob at flake-render time. The harness MCP server
+  remains the hyperhive surface; new servers slot in as additional
+  entries under `mcpServers.<name>` so claude sees them as
+  `mcp__<name>__<tool>`. Per-agent tool whitelist (`allowedTools`)
+  derived from the same config so the operator stays in control of
+  what's exposed.
+
 ## Per-agent settings
 
-- **Model override.** Hard-coded to `haiku` in the turn loop right now.
-  Surface as a per-agent override: operator via dashboard, manager via
-  `request_apply_commit` setting an attr on the agent's flake (most natural
-  place since the flake already carries per-agent env/identity). Pair with
-  a **model status** indicator on the agent page (active / queued / last
-  switched) once the override is in place.
+- **Model override persistence.** `/model <name>` already switches
+  the model at runtime via `Bus::set_model`; the chip on the agent
+  page reflects the current value. Override is in-memory only and
+  resets on harness restart — by design for now, but consider
+  optional persistence (`/state/model` file?) so an operator-set
+  model survives a rebuild.
 
 ## UI / UX