refactor(#1865): consolidate agent + manager socket servers into one

The per-agent and manager sockets ran two parallel dispatchers with
duplicated lifecycle handlers (agent-side topology-gated, manager-side
ungated) plus a manager-only handler set. Collapse to one parameterized
server in socket_server.rs:

- one serve() + dispatch(req, agent, privileged, coord); start() binds
  the per-agent sockets (privileged=false), start_manager() binds the
  manager socket (privileged=true).
- each lifecycle/config handler (start/restart/kill/update/init_config/
  apply_commit) merges its dual: the topology guard (require_child /
  require_new_child) runs only on the !privileged path; init_config
  records the requester as parent only when !privileged. restart keeps
  the orthogonal, capability-gated + audited infra-container branch.
- the agent-state queries (loose-ends / reminder count + rollup) branch
  on privileged: privileged keeps any-target + the "*" hive-wide sweep
  (query_agent_state-gated), non-privileged keeps the topology/cap gate.
- the privileged-only verbs (schedules / meta-inputs / get_logs) plus
  the submit/schedule/watchdog helpers move into socket_server; they are
  reached via dispatch_privileged_only(), which rejects the whole group
  on a non-privileged socket.
- delete manager_server.rs; repoint refs; merge the test modules.

No behavior change: the topology guard still applies on every
non-privileged lifecycle call, the privileged socket still acts on any
agent, and privileged-only verbs are still rejected on agent sockets.

hive-c0re/src/coordinator.rs

@@ -522,7 +522,7 @@ impl Coordinator {
         let mut schedules: Vec<hive_sh4re::WireSchedule> = match self.scheduled_prompts.list() {
             Ok(rows) => rows
                 .into_iter()
-                .map(crate::manager_server::schedule_to_wire_public)
+                .map(crate::socket_server::schedule_to_wire_public)
                 .collect(),
             Err(e) => {
                 tracing::warn!(error = ?e, "emit_schedules_snapshot: list failed");
@@ -534,7 +534,7 @@ impl Coordinator {
         // momentarily contended we emit unfiltered rather than block this
         // sync path — the next snapshot / page reload corrects it.
         if let Some(live) = self.live_container_names_blocking() {
-            crate::manager_server::filter_ghost_schedule_targets(&mut schedules, &live);
+            crate::socket_server::filter_ghost_schedule_targets(&mut schedules, &live);
         }
         self.emit_dashboard_event(DashboardEvent::SchedulesChanged {
             seq: self.next_seq(),
@@ -1330,7 +1330,7 @@ impl Coordinator {
     }
 
     /// Ensure a runtime dir + (for sub-agents) per-agent socket exists. For
-    /// the manager, `manager_server::start` owns the socket — just return
+    /// the manager, `socket_server::start_manager` owns the socket — just return
     /// the dir. For sub-agents this is `register_agent` (creates a fresh
     /// listener bound to `socket_path(name)`). Source directory of the
     /// `/run/hive/mcp.sock` bind that ends up in `set_nspawn_flags`.