swarm-ui: set the review classifier's keys from the classifier settings

The classifier's Anthropic and ACP provider keys were written by hand in the
secret store's UI. The controller now stores them: GET
/api/review-classifier/keys says whether each is set and when it changed, and
PUT /api/review-classifier/keys/{runtime} writes one. No route answers a key.

The controller's store policy gains create and update on the two leaves with
no read of their values, and a metadata read for the set state. The swarm UI's
classifier settings card gets a key form beside the settings, saved apart
because it goes to the secret store.

nix/host-modules/deploy.nix

@@ -638,7 +638,7 @@ in
       description = ''
         Run the review classifier in a `swarm-review-classifier` container on
         this host. It answers the swarm UI's review try-outs with `claude` on
-        the Anthropic API key the operator writes to the secret store at
+        the Anthropic API key the operator sets in the swarm UI, or writes to the secret store at
         `secret/swarm/services/review-classifier/anthropic-api-key`, field
         `api_key`.
 

nix/host-modules/swarm-bao.nix

@@ -562,6 +562,22 @@ let
       capabilities = ["create", "read", "update"]
     }
 
+    path "${credentialMountPath}/data/${classifierApiKeyLeaf}" {
+      capabilities = ["create", "update"]
+    }
+
+    path "${credentialMountPath}/metadata/${classifierApiKeyLeaf}" {
+      capabilities = ["read"]
+    }
+
+    path "${credentialMountPath}/data/${classifierAcpKeyLeaf}" {
+      capabilities = ["create", "update"]
+    }
+
+    path "${credentialMountPath}/metadata/${classifierAcpKeyLeaf}" {
+      capabilities = ["read"]
+    }
+
     path "${credentialMountPath}/data/${builderForgeTokenLeaf}" {
       capabilities = ["create", "read", "update"]
     }
@@ -775,7 +791,10 @@ let
   classifierForgeTokenLeaf = "swarm/services/review-classifier/forge/token";
 
   # The review classifier's Anthropic API key. The operator writes it through
-  # the UI's OIDC login; the classifier reads it on every run.
+  # the UI's OIDC login, or the swarm UI's classifier settings, which the
+  # controller writes for them: `create` and `update` with no `read`, and a
+  # metadata `read` for whether one is set and when it changed. The classifier
+  # reads it on every run.
   classifierApiKeyLeaf = "swarm/services/review-classifier/anthropic-api-key";
 
   # The swarm builder's forge token, the nix half of