Add a request to mark hosts and the controller as needing a restart

Not every plugin arrives through PluginInstallRequest. Plugins checked
out into external_plugins or installed by hand on the machine never
flag a restart, so the web UI shows nothing and tooling that acts on
the flag never fires.

HostMarkRestartRequiredRequest and ControllerMarkRestartRequiredRequest
set config.restartRequired, guarded by the existing restart
permissions. They are exposed as "Mark Restart Required" in the control
dropdown of the host and controller pages, hidden once the flag is set,
and as mark-restart-required ctl commands. The mark shows up on the
next system metrics poll.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/managing-a-cluster.md

@@ -43,6 +43,14 @@ The controller also supports remote updates, following the same logic. The corre
     ctl> controller update [--restart]
     controller> config set controller.allow_remote_updates true/false
 
+### Mark restart required
+
+    ctl> host mark-restart-required <host>
+
+Marks the host as requiring a restart, the same way a plugin update does. Use it after installing or changing a plugin by other means than `host plugin install`, such as a plugin checked out into `external_plugins`. The mark shows up in the web interface on the next system metrics poll. The controller has the same command:
+
+    ctl> controller mark-restart-required
+
 ## Instances
 
 ### List Instances