Add Reboot and Shutdown buttons to Settings page

POST /api/system/reboot → systemctl reboot
POST /api/system/shutdown → systemctl poweroff
Both require confirm() before executing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

audit/internal/webui/api.go

@@ -1292,6 +1292,22 @@ func (h *handler) handleAPIInstallToRAM(w http.ResponseWriter, r *http.Request)
 	_ = json.NewEncoder(w).Encode(map[string]string{"task_id": t.ID})
 }
 
+func (h *handler) handleAPISystemReboot(w http.ResponseWriter, r *http.Request) {
+	if err := exec.Command("systemctl", "reboot").Start(); err != nil {
+		writeError(w, http.StatusInternalServerError, "reboot failed: "+err.Error())
+		return
+	}
+	writeJSON(w, map[string]string{"status": "rebooting"})
+}
+
+func (h *handler) handleAPISystemShutdown(w http.ResponseWriter, r *http.Request) {
+	if err := exec.Command("systemctl", "poweroff").Start(); err != nil {
+		writeError(w, http.StatusInternalServerError, "shutdown failed: "+err.Error())
+		return
+	}
+	writeJSON(w, map[string]string{"status": "shutting down"})
+}
+
 // ── Tools ─────────────────────────────────────────────────────────────────────
 
 var standardTools = []string{

audit/internal/webui/page_settings.go

@@ -88,5 +88,28 @@ checkTools();
   </div>
 </div>
 
+<div class="card">
+  <div class="card-head">Power</div>
+  <div class="card-body">
+    <div style="display:flex;gap:8px;align-items:center">
+      <button class="btn btn-secondary btn-sm" onclick="systemPower('reboot')">Reboot</button>
+      <button class="btn btn-secondary btn-sm" onclick="systemPower('shutdown')">Shutdown</button>
+      <span id="power-status" style="font-size:12px;color:var(--muted)"></span>
+    </div>
+  </div>
+</div>
+
+<script>
+function systemPower(action) {
+  var label = action === 'reboot' ? 'reboot' : 'shut down';
+  if (!confirm('Are you sure you want to ' + label + ' the server?')) return;
+  var el = document.getElementById('power-status');
+  if (el) el.textContent = action === 'reboot' ? 'Rebooting...' : 'Shutting down...';
+  fetch('/api/system/' + action, {method: 'POST'})
+    .then(function(r) { return r.json(); })
+    .catch(function(e) { if (el) el.textContent = 'Error: ' + e.message; });
+}
+</script>
+
 `
 }

audit/internal/webui/server.go

@@ -332,6 +332,8 @@ func NewHandler(opts HandlerOptions) http.Handler {
 	// System
 	mux.HandleFunc("GET /api/system/ram-status", h.handleAPIRAMStatus)
 	mux.HandleFunc("POST /api/system/install-to-ram", h.handleAPIInstallToRAM)
+	mux.HandleFunc("POST /api/system/reboot", h.handleAPISystemReboot)
+	mux.HandleFunc("POST /api/system/shutdown", h.handleAPISystemShutdown)
 
 	// Preflight
 	mux.HandleFunc("GET /api/preflight", h.handleAPIPreflight)