As @rhuk points out, an interface for direct commands is inadvisable unless expressly for system administrators who know exactly what they are doing. Even then, they should be using a regular terminal via SSH. Rather, you want buttons that send preset commands to the server via an API, which are validated and authorized on both ends.
Depending on how tightly you couple this with Grav, you'll want an API (like REST) to execute when a call is made to something like /api/command/flush. You'll create and test these commands in PHP as POST-requests, then afterwards write the interface for them. I am working on a Laravel-project doing something similar currently, which handles the API-part marvelously easily. The interface is written with VueJS, and together they make authorization and validation easy to create and maintain.