remove hive-level infra-container restart from web ui and agents

docs/web-ui/dashboard.md

@@ -159,24 +159,17 @@ omitted — agents share the host netns, so there is no per-container net
 counter (per-agent network needs the netns-isolation roadmap in
 `docs/network.md`).
 
-**1NFR4** — start / stop / restart the four hive infrastructure services
-(`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`) directly from the
-dashboard, without needing an `infra_admin` agent's `restart` MCP tool.
-Three are containers; `hive-gateway` is the host's `nginx.service`, and is
-the one an agent may **not** restart — this panel is the way it gets
-bounced. One row per service: name, a `badge-ok`/`badge-fail`
-running/stopped dot, and `↺ R3ST4RT` + `■ ST0P` (running) or `▶ ST4RT`
-(stopped) buttons, same themed-confirm pattern as the K3PT ST4T3
-tombstone actions. Backed by
-`POST /api/infra-container/{name}/{action}` (`action` ∈
-`start|stop|restart`), which calls the same
-`priv_client::control_infra_container` helper the agent-facing
-`infra_admin` path uses — no new privileged-helper surface, no
-capability check (the dashboard is already operator-authenticated).
+**1NFR4** — start / stop the four hive infrastructure services (`hive-ci`,
+`hive-forge`, `hive-gateway`, `hive-matrix`) directly from the dashboard —
+operator-only, no agent-facing equivalent. One row per service: name, a
+`badge-ok`/`badge-fail` running/stopped dot, and `■ ST0P` (running) or
+`▶ ST4RT` (stopped) buttons, same themed-confirm pattern as the K3PT ST4T3
+tombstone actions. Backed by `POST /api/infra-container/{name}/{action}`
+(`action` ∈ `start|stop`), which calls `priv_client::control_infra_container`
+— no capability check (the dashboard is already operator-authenticated).
 Every attempt is written to the audit log (actor `"operator"`, action
-`start_infra`/`stop_infra`/`restart_infra`) alongside agent-driven infra
-restarts. Status rows ride the `infra_containers` field on
-`GET /api/state`'s `StateSnapshot` (`{name, running}`, live
+`start_infra`/`stop_infra`). Status rows ride the `infra_containers` field
+on `GET /api/state`'s `StateSnapshot` (`{name, running}`, live
 `systemctl is-active container@<unit>.service` read); `core.js` polls
 `/api/state` every 5 s only while the 1NFR4 sub-tab is active, same
 cadence/lifecycle as C0NT41N3R L04D's polling.
@@ -440,7 +433,6 @@ The current capabilities are:
 | `manage_root_agent` | allows the `set_status` / lifecycle tools on the root agent |
 | `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container |
 | `query_agent_state` | allows `get_loose_ends(agent: "<name>")` calls targeting other agents |
-| `infra_admin` | allows `restart` on hive infrastructure containers (`hive-ci`, `hive-forge`, `hive-matrix`; the gateway is operator-only); each restart is logged to the AUDIT trail |
 
 Each row is one agent. Columns are the capability names returned by
 `GET /api/capabilities` as `caps: Vec<String>`. Checking or unchecking
@@ -754,17 +746,20 @@ chip ticks every 30 s. Available to the operator unconditionally (not
 capability-gated — the endpoint lives on the hive-c0re dashboard,
 behind the gateway).
 
-**AUDIT sub-tab** — operator-visible trail of agent-initiated
-privileged actions (e.g. infra-container restarts via `infra_admin`).
-Lazy-fetched on tab show (like SYSTEM) from `GET /api/audit-log`, which
-returns `{ entries, total }` — `entries` newest-first, server-clamped to
-the latest 500; `total` drives a "latest 500 of N" count so the clamp is
-never silent. Rendered as a filterable table (when / agent / action /
-target / outcome / detail); the filter box is a client-side substring
-match over the cached rows. The outcome badge colours `ok` green and
-`err` red, with an `err` whose `detail` starts `denied:` (a capability
-refusal) shown amber and labelled `denied` so it reads apart from an
-execution failure. `ts_unix` is an RFC 3339 string; a 30 s ticker keeps the
+**AUDIT sub-tab** — operator-visible trail of privileged actions worth a
+durable who/what/when record (currently: infra-container start/stop from
+the 1NFR4 panel — see `hive-c0re/src/stores/audit_log.rs`'s doc comment
+for what's in scope). Lazy-fetched on tab show (like SYSTEM) from
+`GET /api/audit-log`, which returns `{ entries, total }` — `entries`
+newest-first, server-clamped to the latest 500; `total` drives a "latest
+500 of N" count so the clamp is never silent. Rendered as a filterable
+table (when / agent / action / target / outcome / detail); the filter box
+is a client-side substring match over the cached rows. The outcome badge
+colours `ok` green and `err` red, with an `err` whose `detail` starts
+`denied:` (a capability refusal) shown amber and labelled `denied` so it
+reads apart from an execution failure — generic styling for whichever
+future privileged action writes that prefix, nothing currently produces
+it. `ts_unix` is an RFC 3339 string; a 30 s ticker keeps the
 relative "ago" column honest while the tab is in view. The backing
 `audit_log` store records every privileged-action attempt (ok / err /
 denied). New entries live-append without a refresh: an `audit_entry_added`
@@ -1254,16 +1249,14 @@ below — some endpoints aren't in it yet.
   a background `du -sxb` of the agent's state dir + container writable
   rootfs every ~5 min, `-x` excluding the shared read-only nix store.
   `null` until the first sample lands.
-- `POST /api/infra-container/{name}/{action}` — start / stop / restart a
-  hive infra service (C0R3 › 1NFR4 panel). `name` parses into the
+- `POST /api/infra-container/{name}/{action}` — start / stop a hive infra
+  service (C0R3 › 1NFR4 panel, operator-only). `name` parses into the
   `InfraContainer` allowlist (`hive-ci`/`hive-forge`/`hive-gateway`/
   `hive-matrix`, 400 on unknown), and the variant decides the unit —
   `container@<name>.service`, or `nginx.service` for the gateway.
-  `action` ∈ `start|stop|restart`. Calls
-  the same `priv_client::control_infra_container` helper the
-  `infra_admin` agent path uses; records an `audit_log` entry
-  (`start_infra`/`stop_infra`/`restart_infra`, actor `"operator"`) either
-  way.
+  `action` ∈ `start|stop`. Calls `priv_client::control_infra_container`;
+  records an `audit_log` entry (`start_infra`/`stop_infra`, actor
+  `"operator"`) either way.
 - `POST /api/cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /api/retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).