feat: add infra container start/stop/restart tab to C0R3 page

New POST /api/infra-container/{name}/{action} dashboard route (start/
stop/restart on hive-ci/hive-forge/hive-gateway/hive-matrix), reusing
the existing priv_client::control_infra_container helper the
infra_admin agent path already uses, plus an audit_log entry per
attempt. Adds infra_containers to the /api/state StateSnapshot (name +
live running status via systemctl is-active). New 1NFR4 sub-tab on the
C0R3 dashboard page: one row per infra container with a running/
stopped badge and start/stop/restart buttons, polled every 5s while
the sub-tab is open.

docs/web-ui/dashboard.md

@@ -127,7 +127,7 @@ Passive / rare-interaction state. No longer a dashboard tab — it's a
 standalone page reached from the **Core** tile on the H0M3 hub (served at
 `/core.html`), with the same minimal chrome as `/logs.html`: a `← home`
 back-link + a `createTabStrip` sub-tab nav (**K3PT ST4T3** default,
-then **C0NT41N3R L04D**). The page is its own esbuild bundle (`core.js`)
+then **C0NT41N3R L04D**, then **1NFR4**). The page is its own esbuild bundle (`core.js`)
 that cold-loads `/api/state` and subscribes to `/api/dashboard/stream` for
 `tombstones_changed`, `capabilities_changed`, and `tool_groups_changed`
 (the latter two re-render the stale-perms sub-section when permission
@@ -169,6 +169,26 @@ omitted — agents share the host netns, so there is no per-container net
 counter (per-agent network needs the netns-isolation roadmap in
 `docs/network.md`).
 
+**1NFR4** — start / stop / restart the four hive infrastructure
+containers (`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`)
+directly from the dashboard, without needing an `infra_admin` agent's
+`restart` MCP tool. One row per container: name, a `badge-ok`/`badge-fail`
+running/stopped dot, and `↺ R3ST4RT` + `■ ST0P` (running) or `▶ ST4RT`
+(stopped) buttons, same themed-confirm pattern as the K3PT ST4T3
+tombstone actions. Backed by
+`POST /api/infra-container/{name}/{action}` (`action` ∈
+`start|stop|restart`), which calls the same
+`priv_client::control_infra_container` helper the agent-facing
+`infra_admin` path uses — no new privileged-helper surface, no
+capability check (the dashboard is already operator-authenticated).
+Every attempt is written to the audit log (actor `"operator"`, action
+`start_infra`/`stop_infra`/`restart_infra`) alongside agent-driven infra
+restarts. Status rows ride the `infra_containers` field on
+`GET /api/state`'s `StateSnapshot` (`{name, running}`, live
+`systemctl is-active container@<unit>.service` read); `core.js` polls
+`/api/state` every 5 s only while the 1NFR4 sub-tab is active, same
+cadence/lifecycle as C0NT41N3R L04D's polling.
+
 ## BU1LDS page (`/builds.html`)
 
 The build lifecycle hub — rebuild queue, live build log, meta inputs,
@@ -1195,6 +1215,14 @@ that's a browser-level decision, not ours.
   a background `du -sxb` of the agent's state dir + container writable
   rootfs every ~5 min, `-x` excluding the shared read-only nix store.
   `null` until the first sample lands.
+- `POST /api/infra-container/{name}/{action}` — start / stop / restart a
+  hive infra container (C0R3 › 1NFR4 panel). `name` parses into the
+  `InfraContainer` allowlist (`hive-ci`/`hive-forge`/`hive-gateway`/
+  `hive-matrix`, 400 on unknown), `action` ∈ `start|stop|restart`. Calls
+  the same `priv_client::control_infra_container` helper the
+  `infra_admin` agent path uses; records an `audit_log` entry
+  (`start_infra`/`stop_infra`/`restart_infra`, actor `"operator"`) either
+  way.
 - `POST /api/cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /api/retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).