swarm ui: show when an agent's claude login was stored, and delete it

The agent's settings get a claude login row: when the swarm stored the
login, read by the minter from the leaf's metadata, or that none is, with a
delete that removes every version after a confirmation. New minter steps
(status, delete), controller routes (GET claude-login, DELETE
claude-login/stored) and a read and delete grant on the leaf's metadata,
pinned in the module-eval check.

nix/host-modules/swarm-bao.nix

@@ -1353,7 +1353,10 @@ let
 
   # The claude login minter: every agent's `claude-credentials` leaf,
   # create and update so a relogin replaces the last, and nothing else under
-  # an agent; and its own queue client secret, read at start.
+  # an agent; the leaf's metadata, to say when it was written (`read`) and to
+  # delete every version of it (`delete`; the `data/` path's delete would leave
+  # the older versions, each a live session), never the credential itself; and
+  # its own queue client secret, read at start.
   claudeLoginWriters = [
     {
       name = "swarm-claude-login";
@@ -1362,6 +1365,9 @@ let
         path "${credentialMountPath}/data/swarm/agents/+/claude-credentials" {
           capabilities = ["create", "update"]
         }
+        path "${credentialMountPath}/metadata/swarm/agents/+/claude-credentials" {
+          capabilities = ["read", "delete"]
+        }
       ''
       + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.claude-login.clientId}/oidc/client";
     }
@@ -2294,8 +2300,9 @@ in
       description = ''
         Subject the store's `swarm-claude-login` cert-auth role accepts: the
         identity the claude login minter presents from inside its container.
-        Its grant is create and update on `swarm/agents/+/claude-credentials`
-        and read on its own queue client secret.
+        Its grant is create and update on `swarm/agents/+/claude-credentials`,
+        read and delete on that leaf's metadata, and read on its own queue client
+        secret.
 
         ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
       '';