ask_operator: ttl_seconds auto-cancel + remaining-time chip

manager can pass ttl_seconds to ask_operator. on submit, host
stores deadline_at = now + ttl in operator_questions (new column,
migrated via existing pragma_table_info pattern), spawns a tokio
task that sleeps until the deadline then resolves the question with
answer '[expired]' and fires the same OperatorAnswered helper event.
already-resolved races no-op silently.

dashboard renders a '⏳ MM:SS' chip on the question row when
deadline_at is set. format collapses seconds → s, < 1h → m s, ≥ 1h
→ h m. heartbeat refresh (5s) keeps the chip current; the operator
sees it tick down.

manager prompt + mcp tool description updated. journald viewer per
container queued in todo (separate task).

hive-c0re/src/manager_server.rs

@@ -72,7 +72,7 @@ async fn serve(stream: UnixStream, coord: Arc<Coordinator>) -> Result<()> {
 const MANAGER_RECV_LONG_POLL: std::time::Duration = std::time::Duration::from_secs(30);
 
 #[allow(clippy::too_many_lines)]
-async fn dispatch(req: &ManagerRequest, coord: &Coordinator) -> ManagerResponse {
+async fn dispatch(req: &ManagerRequest, coord: &Arc<Coordinator>) -> ManagerResponse {
     match req {
         ManagerRequest::Send { to, body } => match coord.broker.send(&Message {
             from: MANAGER_AGENT.to_owned(),
@@ -198,14 +198,26 @@ async fn dispatch(req: &ManagerRequest, coord: &Coordinator) -> ManagerResponse
             question,
             options,
             multi,
+            ttl_seconds,
         } => {
-            tracing::info!(%question, ?options, multi, "manager: ask_operator");
+            tracing::info!(%question, ?options, multi, ?ttl_seconds, "manager: ask_operator");
+            let deadline_at = ttl_seconds.and_then(|s| {
+                let now = std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .ok()
+                    .and_then(|d| i64::try_from(d.as_secs()).ok())
+                    .unwrap_or(0);
+                i64::try_from(s).ok().map(|s| now + s)
+            });
             match coord
                 .questions
-                .submit(MANAGER_AGENT, question, options, *multi)
+                .submit(MANAGER_AGENT, question, options, *multi, deadline_at)
             {
                 Ok(id) => {
-                    tracing::info!(%id, "operator question queued");
+                    tracing::info!(%id, ?deadline_at, "operator question queued");
+                    if let Some(ttl) = *ttl_seconds {
+                        spawn_question_watchdog(coord, id, ttl);
+                    }
                     ManagerResponse::QuestionQueued { id }
                 }
                 Err(e) => ManagerResponse::Err {
@@ -227,3 +239,28 @@ async fn dispatch(req: &ManagerRequest, coord: &Coordinator) -> ManagerResponse
         }
     }
 }
+
+/// On `AskOperator { ttl_seconds: Some(n) }`, sleep n seconds and then
+/// try to resolve the question with `[expired]`. If the operator (or
+/// any other path) already answered it, `answer()` returns Err and
+/// we no-op silently. Otherwise fire the usual `OperatorAnswered`
+/// helper event so the manager sees a terminal state.
+const TTL_SENTINEL: &str = "[expired]";
+
+fn spawn_question_watchdog(coord: &Arc<Coordinator>, id: i64, ttl_secs: u64) {
+    let coord = coord.clone();
+    tokio::spawn(async move {
+        tokio::time::sleep(std::time::Duration::from_secs(ttl_secs)).await;
+        // `answer` returns Err if already resolved — that's the
+        // normal path when the operator responded before the ttl
+        // fired, so no-op silently.
+        if let Ok(question) = coord.questions.answer(id, TTL_SENTINEL) {
+            tracing::info!(%id, "operator question expired (ttl)");
+            coord.notify_manager(&hive_sh4re::HelperEvent::OperatorAnswered {
+                id,
+                question,
+                answer: TTL_SENTINEL.to_owned(),
+            });
+        }
+    });
+}