panel-redesign: an idle one-shot helper is "on demand", not "stopped"

The owner's choice (2026-10-10) for the last line of the Processes table
on Server > Health: postfix-reload runs when the configuration is
reloaded and exits, so between runs supervisord calls it STOPPED - a
word that reads as a fault beside six running programs, in a box that
rightly says ok. Its row now has the neutral tag "on demand" and says
when it last ran (or that it has not run since the container started).
A one-shot in trouble keeps supervisord's word and level, and a daemon
that is stopped is still an error.

  go test -count=1 ./internal/web/...: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_status.go

@@ -150,9 +150,7 @@ func healthPage(m view.Meta, c map[string]any, flash string) *view.Health {
 	page.Processes.End = view.Verdict(string(c["ProcessStatus"].(health.Status)))
 	page.ProcessError = c["ProcessError"].(bool)
 	for _, p := range c["Processes"].([]health.Process) {
-		page.ProcessRows = append(page.ProcessRows, view.ProcessRow{
-			Name: p.Name, State: view.Tag{Status: string(p.Status), Label: strings.ToLower(p.State)}, Detail: p.Detail,
-		})
+		page.ProcessRows = append(page.ProcessRows, processRow(p))
 	}
 
 	cert := c["Cert"].(health.Certificate)
@@ -194,6 +192,24 @@ func healthPage(m view.Meta, c map[string]any, flash string) *view.Health {
 	return page
 }
 
+// processRow is one line of the Processes table. A one-shot helper that sits
+// idle is not "stopped" the way a daemon is: it runs when asked and exits, so
+// its row says "on demand" in a neutral tag and when it last ran, instead of a
+// word that reads as a fault beside the running programs.
+func processRow(p health.Process) view.ProcessRow {
+	if p.OneShot && p.Status == health.StatusOK && p.State != "RUNNING" {
+		detail := "Runs when the configuration is reloaded"
+		switch {
+		case p.Detail == "" || strings.EqualFold(p.Detail, "Not started"):
+			detail += "; not run since the container started"
+		default:
+			detail += "; last run: " + p.Detail
+		}
+		return view.ProcessRow{Name: p.Name, State: view.Tag{Status: "off", Label: "on demand"}, Detail: detail}
+	}
+	return view.ProcessRow{Name: p.Name, State: view.Tag{Status: string(p.Status), Label: strings.ToLower(p.State)}, Detail: p.Detail}
+}
+
 // machineRows is the Machine table: processor and memory as bars with their
 // figure, the network as rates, and for each the sentence the sampler gave. A
 // reading that could not be taken keeps its row, without a figure.