surface rate_limited status as red badge on per-agent page and dashboard

- add rate_limited: Arc<AtomicBool> to Bus; set/cleared by emit_status
- write/remove sentinel file hyperhive-rate-limited in state dir so host-side
  dashboard can detect it without a live socket call
- api_state returns status=rate_limited when flag is set (cold-load accurate)
- ALIVE_LABELS gains rate_limited entry (⊘ red chip) on per-agent page
- ContainerView gains rate_limited: bool read from sentinel file
- dashboard container row shows ⊘ rate limited badge (red) ahead of needs_login

Closes #24

hive-c0re/src/container_view.rs

@@ -44,6 +44,12 @@ pub struct ContainerView {
     /// the "which agent is close to the window?" dashboard glance.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub ctx_tokens: Option<u64>,
+    /// True while the harness is parked after an API rate-limit response.
+    /// Detected via the sentinel file `{state_dir}/hyperhive-rate-limited`
+    /// that the harness writes in `Bus::emit_status("rate_limited")` and
+    /// removes when it resumes. Stale by up to one crash-watch cycle.
+    #[serde(default)]
+    pub rate_limited: bool,
 }
 
 /// Build the full container list. Wraps `lifecycle::list()` and
@@ -83,6 +89,7 @@ pub async fn build_all(coord: &Coordinator) -> Vec<ContainerView> {
             .count_pending_reminders_for(reminder_recipient)
             .unwrap_or(0);
         let ctx_tokens = read_last_ctx_tokens(&logical);
+        let rate_limited = is_rate_limited(&logical);
         out.push(ContainerView {
             port: lifecycle::agent_web_port(&logical),
             running: lifecycle::is_running(&logical).await,
@@ -94,6 +101,7 @@ pub async fn build_all(coord: &Coordinator) -> Vec<ContainerView> {
             deployed_sha,
             pending_reminders,
             ctx_tokens,
+            rate_limited,
         });
     }
     out
@@ -112,6 +120,15 @@ pub fn claude_has_session(dir: &Path) -> bool {
         .any(|e| e.file_type().is_ok_and(|t| t.is_file()))
 }
 
+/// Returns true if the agent's harness is currently parked after an API
+/// rate-limit response. Detected via the sentinel file written by
+/// `hive_ag3nt::events::Bus::emit_status("rate_limited")`.
+fn is_rate_limited(name: &str) -> bool {
+    Coordinator::agent_notes_dir(name)
+        .join("hyperhive-rate-limited")
+        .exists()
+}
+
 /// Read the most recent completed turn's context-window size (prompt
 /// tokens) from the agent's turn-stats SQLite. Returns `None` when
 /// the file is absent or has no rows. Best-effort — any DB error