Gate endpoint UI refresh on fresh telemetry and land endpoint agent

A command reaching 'succeeded' only proves the agent ran the action, not that it posted a new telemetry snapshot. Reloading panels on command success alone re-rendered stale service/process rows, so a stopped process could still show running right after Refresh Status.

Add a lightweight telemetrymeta probe exposing lastreportedat and gate both the header Refresh Status action and inline row Start/Stop on that stamp advancing past a pre-action baseline. Polling is bounded so an offline or idle agent never hangs the button, and messaging distinguishes a confirmed refresh from a queued one.

Bring the .NET endpoint agent source (service, tray, installer) into the repo so Cameron can merge and test, with an agent/.gitignore keeping bin/obj/publish out. Includes the DncMain launch-path fix, tray single-file host env scrub, and best-effort file logger.

plugins/endpoints/plugin.py

@@ -108,6 +108,11 @@ class EndpointsPlugin(BasePlugin):
             # shop-floor PC is a heavier grant than reading its telemetry.
             ('endpoints.command',
              'Send allowlisted commands to endpoint agents', 'endpoints'),
+            # Elevated grant for destructive endpoint actions (system_restart).
+            # Required IN ADDITION to endpoints.command by the enqueue route, so a
+            # remote reboot is a strictly heavier grant than a routine toggle.
+            ('endpoints.restart',
+             'Restart endpoint computers (destructive)', 'endpoints'),
             # Collector service scope for the endpoint agent. A managed token
             # scoped to ONLY this authorizes the endpoints collector and nothing
             # else, so rotating/revoking it stops endpoint-agent traffic without
@@ -181,6 +186,8 @@ class EndpointsPlugin(BasePlugin):
                 'icon': 'activity',
                 'route': '/endpoints',
                 'position': 16,
+                'permission': 'endpoints.view',
+                'section': 'fleet',
             },
         ]
 
@@ -192,11 +199,13 @@ class EndpointsPlugin(BasePlugin):
     def get_asset_panels(self) -> List[Dict]:
         """Per-PC detail panels, computer assets only.
 
-        Three panels feeding the generic renderer: the current status snapshot
-        (keyvalue), monitored services with a run-state badge (list), and the
-        most recent curated events (list). Each is a single-asset indexed read,
-        so the cost is the same profile as the warranty/backups panels. Panels
-        hide themselves when their endpoint returns nothing.
+        Panels feeding the generic renderer: the current status snapshot
+        (keyvalue), monitored services and processes split into two list cards
+        that share one services snapshot (filtered by kind), the most recent
+        curated events (list), and the network interfaces (table). Each is a
+        single-asset indexed read, so the cost is the same profile as the
+        warranty/backups panels. Panels hide themselves when their endpoint
+        returns nothing.
         """
         return [
             {
@@ -209,12 +218,13 @@ class EndpointsPlugin(BasePlugin):
                 'position': 10,
             },
             {
-                'id': 'endpoints-services',
-                'title': 'Services and processes',
+                'id': 'endpoints-tracked-services',
+                'title': 'Tracked Services',
                 'assettypes': ['computer'],
                 'endpoint': '/api/endpoints/asset/{assetid}/services',
                 'render': 'list',
                 'collapsible': True,
+                'filter': {'key': 'kind', 'equals': 'service'},
                 'status': {
                     'key': 'statecolor',
                     'levels': {
@@ -233,6 +243,32 @@ class EndpointsPlugin(BasePlugin):
                 'empty': 'No monitored services reported.',
                 'position': 12,
             },
+            {
+                'id': 'endpoints-tracked-processes',
+                'title': 'Tracked Processes',
+                'assettypes': ['computer'],
+                'endpoint': '/api/endpoints/asset/{assetid}/services',
+                'render': 'list',
+                'collapsible': True,
+                'filter': {'key': 'kind', 'equals': 'process'},
+                'status': {
+                    'key': 'statecolor',
+                    'levels': {
+                        'green': 'ok',
+                        'yellow': 'warning',
+                        'red': 'critical',
+                    },
+                },
+                'map': {
+                    'title': 'name',
+                    'badge': {'label': 'statelabel', 'color': 'statecolor'},
+                    'action': 'action',
+                },
+                'commandendpoint': '/api/endpoints/{assetid}/commands',
+                'permission': 'endpoints.command',
+                'empty': 'No monitored processes reported.',
+                'position': 13,
+            },
             {
                 'id': 'endpoints-events',
                 'title': 'Recent events',
@@ -263,7 +299,8 @@ class EndpointsPlugin(BasePlugin):
                     ],
                 },
                 'empty': 'No recent events.',
-                'position': 14,
+                'collapsedDefault': True,
+                'position': 90,
             },
             {
                 'id': 'endpoints-interfaces',