add a per-agent egress log mode

docs/networking/network.md

@@ -289,6 +289,22 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   restricted. Agents must not start sending credentials until every hive runs
   the `hive-c0re` that writes it, or a legacy agent loses general internet.
 
+- **Log mode.** The operator can put an agent in `log` mode in the swarm UI.
+  Its record keeps `unrestricted_internet` at `false` and adds
+  `internet_log: true`, so a `hive-c0re` that doesn't know the field still
+  enforces the list. For such an agent `hive-c0re` adds to `agent-allow.conf`,
+  after the allow rules for every agent's own names,
+  `http_access allow <user> !allowed_dst log_mark`, where `log_mark` is an
+  `annotate_transaction` ACL that sets `would_deny=1`. The rule comes last in
+  the include, so every destination deny and `deny !authed` before it still
+  applies, and a name the agent may reach never carries the mark. A request the
+  rule lets through gets a second log line,
+  `would_deny user=<agent> method=<m> host=<h> port=<p> result=<r>`, from the
+  `would_denied` `access_log` in `hive-squid.nix`; the usual request line keeps
+  its format. Only the operator changes the mode: nothing moves an agent to
+  `restricted` after a time or a count. The self-check's users aren't agents,
+  so `deny-canary.invalid` stays a 403.
+
 - **Base list.** `services.hyperhive.deploy.hive-controller.squid.baseAllowedDomains` is open to every
   authenticated user, whatever its flag: what the agent harness needs off the
   swarm. The default is the hosts Claude Code requires
@@ -384,7 +400,8 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
 - **Logs.** One syslog line per request reaches the journal as
   `squid.service`, and `services.hyperhive.otel.journalUnits` forwards that
   unit and the self-check's to the swarm's log store. A refusal shows as `TCP_DENIED/403` with the
-  client's source address.
+  client's source address. A request that a `log`-mode agent's rule let
+  through also logs a `would_deny` line (see _Log mode_).
 - **Self-check.** `squid-selfcheck.timer` runs `squid-selfcheck.service`
   every minute from the bridge IP, logging in as `selfcheck.squid`: `CONNECT`
   to `services.hyperhive.deploy.hive-controller.squid.selfcheck.canary` (default: `cache.nixos.org`,