feat: add infra container start/stop/restart tab to C0R3 page

New POST /api/infra-container/{name}/{action} dashboard route (start/
stop/restart on hive-ci/hive-forge/hive-gateway/hive-matrix), reusing
the existing priv_client::control_infra_container helper the
infra_admin agent path already uses, plus an audit_log entry per
attempt. Adds infra_containers to the /api/state StateSnapshot (name +
live running status via systemctl is-active). New 1NFR4 sub-tab on the
C0R3 dashboard page: one row per infra container with a running/
stopped badge and start/stop/restart buttons, polled every 5s while
the sub-tab is open.

hive-c0re/src/dashboard/state_snapshot.rs

@@ -126,6 +126,34 @@ pub(super) struct StateSnapshot {
     /// `host_stats::server_warnings`; the frontend renders this list
     /// generically, so new warning kinds need no frontend change.
     server_warnings: Vec<crate::host_stats::ServerWarning>,
+    /// Live running/stopped status for the four hive infra containers
+    /// (`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`). Feeds the
+    /// C0R3 page's 1NFR4 sub-tab so the operator can start/stop/restart
+    /// them without an `infra_admin` agent's `restart` tool.
+    infra_containers: Vec<InfraContainerView>,
+}
+
+/// One row for the C0R3 page's 1NFR4 sub-tab.
+#[derive(Serialize)]
+struct InfraContainerView {
+    /// Container / systemd-unit name (e.g. `"hive-ci"`).
+    name: &'static str,
+    running: bool,
+}
+
+/// Live running/stopped status for all four hive infra containers.
+/// Extracted out of [`api_state`] to keep it under clippy's
+/// `too_many_lines` limit.
+async fn infra_container_views() -> Vec<InfraContainerView> {
+    let mut infra_containers =
+        Vec::with_capacity(hive_sh4re::priv_proto::InfraContainer::ALL.len());
+    for container in hive_sh4re::priv_proto::InfraContainer::ALL {
+        infra_containers.push(InfraContainerView {
+            name: container.unit_name(),
+            running: crate::lifecycle::infra_is_running(container).await,
+        });
+    }
+    infra_containers
 }
 
 /// One peer hive for the P33RS dashboard tab. Derived from
@@ -357,6 +385,8 @@ pub(super) async fn api_state(
         w
     };
 
+    let infra_containers = infra_container_views().await;
+
     axum::Json(StateSnapshot {
         seq,
         hostname,
@@ -398,6 +428,7 @@ pub(super) async fn api_state(
             .filter(|s| !s.is_empty()),
         peer_hives: parse_peer_hives(),
         server_warnings,
+        infra_containers,
     })
 }