The service's own comment already claimed "list/inspect/exec/restart
existing containers" capability, but ALLOW_RESTARTS was never actually set
-- restart was silently unavailable. Needed for argus-appliance#43's new
Diagnostics "Restart Container" recovery action, which is the first real
caller.
Deliberately narrow, per explicit product decision: restart only (stop/
restart/kill on an *existing* container). create/prune remain denied by
the haproxy template's own explicit deny-list regardless of this or any
POST setting. start/stop (ALLOW_START/ALLOW_STOP) deliberately left unset
-- nothing needs them yet.
