feat: add infra container start/stop/restart tab to C0R3 page

New POST /api/infra-container/{name}/{action} dashboard route (start/
stop/restart on hive-ci/hive-forge/hive-gateway/hive-matrix), reusing
the existing priv_client::control_infra_container helper the
infra_admin agent path already uses, plus an audit_log entry per
attempt. Adds infra_containers to the /api/state StateSnapshot (name +
live running status via systemctl is-active). New 1NFR4 sub-tab on the
C0R3 dashboard page: one row per infra container with a running/
stopped badge and start/stop/restart buttons, polled every 5s while
the sub-tab is open.

hive-c0re/src/lifecycle/mod.rs

@@ -582,6 +582,21 @@ pub async fn is_running(name: &str) -> bool {
         .is_ok_and(|s| s.success())
 }
 
+/// True when a hive infrastructure container's systemd unit is active.
+/// Sibling of [`is_running`] for sub-agents, but infra container/unit names
+/// (`hive-ci`, …) already have no `h-` prefix to strip, so this queries
+/// `container@<unit_name>.service` directly rather than going through
+/// [`container_name`]. Used by the dashboard C0R3 page's 1NFR4 sub-tab to
+/// show each infra container's live status dot.
+pub async fn infra_is_running(container: hive_sh4re::priv_proto::InfraContainer) -> bool {
+    let unit = format!("container@{}.service", container.unit_name());
+    Command::new("systemctl")
+        .args(["is-active", "--quiet", &unit])
+        .status()
+        .await
+        .is_ok_and(|s| s.success())
+}
+
 /// Fully tear down a sub-agent's container: stop + remove via `nixos-container
 /// destroy`, then clean our own systemd drop-in. Leaves it to the caller to
 /// wipe `/var/lib/hyperhive/...` state and the per-agent runtime dir.