swarm UI: show the accounts linked to each agent

GET /api/hives/{hive}/agents/{agent}/linked-accounts returns one row per
account linked to the agent, as kind, name and host: each matrix account
under swarm/agents/<agent>/matrix (with its homeserver, and the agent's own
`main` marked reserved), each forge label under swarm/agents/<agent>/forge
(with its url), and github when swarm/agents/<agent>/github-token exists
(host github.com, which is not stored). No credential field is in the
response type.

Listing those two directories needs a new controller grant: `list` on
secret/metadata/swarm/agents/+/matrix and .../+/forge only, pinned in
bao-grants.nix as the only metadata stanzas under agents/ beside the queue
revocation. Checked against a dev OpenBao 2.6.3: the grant lists those two
directories and is refused on agents/, agents/<agent>/, and a leaf.

The swarm UI agent detail panel shows all rows under "accounts"; the table
view's matrix column shows the matrix rows. The link badges stay.

Refs #4855

frontend/packages/swarm-ui/src/pages/LinkMatrixAccountForm.tsx

@@ -13,10 +13,9 @@
 // same as every other form here, since the response is `problem+json`
 // regardless of which arm fired.
 //
-// No "linked accounts" list to show first: no route exposes one (a
-// credential store shouldn't hand a secret back out anyway), so this is
-// a blind set/update action, not an edit of something already on
-// screen. That matches "make it 1:1 for now, we will split later" and
+// A blind set/update action: no route hands a token back, so there is
+// nothing to edit. What is already linked shows on the agent panel
+// (`LinkedAccounts`), names and hosts only. That matches "make it 1:1 for now, we will split later" and
 // "adding them and assigning them should be separate things" — both
 // mara's rulings on that issue — there's no assignment step here yet,
 // just the write.