Restart page (23), force restarts, Tascam reconnect, ProdCom, Resi encoder

- Page 23 "Restart": hold a key 2 s to restart DVS (4 Macs), ProPresenter,
  Ableton, Church Translate, ProdCom, ProdDash, captions, the bridge or the
  Tascam connection even when the status page says it is fine ("force",
  shared 60 s guard). RESTART PAGE key on page 19, STATUS PAGE back.
- Holds carry Companion's clock; ones queued while the watchdog was down
  are dropped instead of firing together later.
- TASCAM hold always reconnects and checks again after 20 s: HUNG - POWER
  CYCLE IT (pings, control port hung), NO NETWORK, or turns a disabled
  connection on. Tascam pinged at its Companion address.
- INGEST: ProdCom (:24480), ProdDash's page (:24500), the caption screen;
  DVS on Ingest restarts ProdCom afterwards. RESI: the encoder (10.1.10.202).
- Windows starts check the app really started (FIX FAILED otherwise); OBS's
  start task runs elevated (OBS is "Run as administrator"); setup script
  does that for any such app and gives sshd restart-on-failure.
- push_page.py checks what is on the target page, not its name (pages 22
  and 97 are named "PAGE" but hold buttons); --which restart.
- Companion custom variables are written in the request body (no URL limit).
Reviewed by a 3-lens review with per-finding verification; 7 confirmed
issues fixed. Tested live: OBS hold opens OBS; Restart page TASCAM key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

remote-access/windows-setup.ps1

@@ -36,6 +36,7 @@ if (-not (Get-Service sshd -ErrorAction SilentlyContinue)) {
     return
 }
 Set-Service -Name sshd -StartupType Automatic
+sc.exe failure sshd reset= 86400 actions= restart/5000/restart/5000/restart/30000 | Out-Null   # comes back if it stops
 Start-Service sshd
 if (-not (Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue)) {
     New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True `
@@ -80,6 +81,15 @@ $apps = @(
     @{ Name = 'BibleApp'; Exe = $bible; Args = ''; AtLogon = $true }   # also opens it 15 s after login
 )
 $principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -LogonType Interactive -RunLevel Limited
+# An app ticked "Run this program as an administrator" (OBS on the LiveStream PC) cannot start from a
+# Limited task: Windows refuses with 0x800702E4. Its task runs with highest privileges instead.
+$elevated = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -LogonType Interactive -RunLevel Highest
+$layers = @{}
+foreach ($k in 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers',
+               'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers') {
+    $p = Get-ItemProperty $k -ErrorAction SilentlyContinue
+    if ($p) { $p.PSObject.Properties | ForEach-Object { $layers[$_.Name] = "$($_.Value)" } }
+}
 $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
     -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew
 $tasks = @()
@@ -88,8 +98,9 @@ foreach ($app in $apps) {
     $actionArgs = @{ Execute = $app.Exe; WorkingDirectory = (Split-Path $app.Exe) }
     if ($app.Args) { $actionArgs.Argument = $app.Args }
     $action = New-ScheduledTaskAction @actionArgs
+    $runAsAdmin = $layers[$app.Exe] -match 'RUNASADMIN'
     $taskArgs = @{ TaskPath = '\StatusPanel\'; TaskName = ('Start ' + $app.Name); Action = $action
-                   Principal = $principal; Settings = $settings; Force = $true }
+                   Principal = $(if ($runAsAdmin) { $elevated } else { $principal }); Settings = $settings; Force = $true }
     if ($app.AtLogon) {
         $taskArgs.Trigger = New-ScheduledTaskTrigger -AtLogOn -User "$env:USERDOMAIN\$env:USERNAME"
         $taskArgs.Trigger.Delay = 'PT15S'