swarm ui: show when an agent's claude login was stored, and delete it

The agent's settings get a claude login row: when the swarm stored the
login, read by the minter from the leaf's metadata, or that none is, with a
delete that removes every version after a confirmation. New minter steps
(status, delete), controller routes (GET claude-login, DELETE
claude-login/stored) and a read and delete grant on the leaf's metadata,
pinned in the module-eval check.

swarm-secret-client/src/client.rs

@@ -262,6 +262,27 @@ impl SecretStore {
         }
     }
 
+    /// When the newest version at `path` was written, as the store spells the
+    /// time (RFC 3339), or `None` when nothing is stored there.
+    ///
+    /// Reads the metadata only, so it needs `read` on `secret/metadata/<path>`
+    /// and never sees the value: the verb for a caller that may say a secret
+    /// exists and when it changed, but not read it.
+    ///
+    /// **Only a 404 is "nothing stored"**, as in
+    /// [`read_optional`][Self::read_optional]: a denial stays an error.
+    ///
+    /// # Errors
+    /// [`Error::Vault`] for anything that is not a 404: a denial, or an
+    /// unreachable store.
+    pub async fn updated_time(&self, path: &str) -> Result<Option<String>, Error> {
+        match vaultrs::kv2::read_metadata(&self.inner, MOUNT, path).await {
+            Ok(meta) => Ok(Some(meta.updated_time)),
+            Err(e) if is_absent(&e) => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+
     /// The keys stored directly under `path`, or none when nothing is.
     ///
     /// A key ending in `/` is a directory below `path` rather than an object;