dashboard: per-container applied agent.nix viewer

new GET /api/agent-config/{name} returns the contents of
/var/lib/hyperhive/applied/<name>/agent.nix — the file the
container actually builds against. validated against the live
container list to avoid arbitrary filesystem reads.

frontend mirrors the journald viewer: collapsed <details> on each
container row, lazy-fetches on expand, refresh button re-fetches.
restore-keyed (agent-config:<name>) so it survives the dashboard
heartbeat refresh.

read-only — mutating the applied config goes through the existing
request_apply_commit + operator approval flow.

TODO.md

@@ -44,15 +44,6 @@ Pick anything from here when relevant. Cross-cutting design notes live in
 
 ## UI / UX
 
-- **Dashboard: show per-agent applied config.** Surface
-  `/var/lib/hyperhive/applied/<name>/agent.nix` (the file the
-  container actually builds from) as a collapsible `<details>`
-  block on each container row, alongside the journald viewer.
-  Backend: new `GET /api/agent-config/{name}` returns the file
-  contents (text/plain). Frontend: lazy-fetch on expand, render
-  inside a `<pre>` with the same theming as the journal panel.
-  Useful for spot-checking what `request_apply_commit` produced
-  without ssh-ing in.
 - **xterm.js terminal** embedded per-agent, attached to a PTY exposed by
   the harness. Pairs well with the unprivileged-container work — would let
   the operator drop into the container without `nixos-container root-login`.