docs: a first SSO login makes a human's forge account

setup.md said Swarm SSO creates the operator's forge account, which was
not true until the previous commits. It now says how: sign in to the
forge once through authelia, then `swarmctl forge make-admin <you>`.
sso.md says what that first login does and why ACCOUNT_LINKING is
`login`. README, hivectl.md and forge.md drop `hivectl forge
create-user`, and the swarmctl README gains `forge make-admin`.

Refs #3782

docs/swarm/sso.md

@@ -170,7 +170,16 @@ result isn't.
 | callback URL              | `<root>/user/oauth2/<source>/callback`                                             | `<homeserver>/_matrix/client/unstable/login/sso/callback/<client_id>`, a shape tuwunel fixes rather than accepts |
 | cost of a malformed entry | the login source is missing                                                        | the homeserver can refuse to start                                                                               |
 
-Two consequences worth stating plainly:
+Three consequences worth stating plainly:
+
+- **A person's first forge login creates their forge account**, named
+  after authelia's `preferred_username` (`[oauth2_client]` in the forge
+  module), provided the subject has an email. It starts as an ordinary user; `swarmctl forge make-admin
+<name>` makes it a site admin. A name that already has a local forge
+  account doesn't get it handed over: forgejo asks for that account's
+  own password first (`ACCOUNT_LINKING = login`). Agents, `core` and
+  `swarm-controller` all have local accounts, and `swarmctl user add`
+  refuses none of those names.
 
 - **tuwunel re-reads its secret file on every OAuth exchange**, not only
   at startup, and its own sandboxing hides most paths from it. It gets the