review classifier: run on ACP when the swarm settings choose it

The swarm settings gain `runtime` (`api-key`, the default, or `acp`) and
an `acp` provider record: an https base URL, the provider's model, and
its prices per million tokens. A PUT now changes only the fields its
body names, so the settings form that sends model, effort and limit
leaves the runtime alone; `null` clears `effort` or `acp`. The body stays
strict, and the stored document keeps #5192's lenient read.

The controller sends the runtime in each run request. On `acp` the
classifier runs one prompt on a new `opencode acp` session per
classification through hive-runtime's AcpRuntime, in a scratch
directory, with a config rendered from the settings. opencode runs
`read` and other tools without asking, so OPENCODE_PERMISSION
{"*":"deny"} takes every tool away from the model, and a deny-all policy
refuses any request on top. The title call, which resends the prompt,
is turned off. The deadline cancels the turn, and a turn that does not
end within 15s of that is dropped, which also covers an agent stuck
before its prompt. The answer is the final assistant text, as ACP has
no result event.

The provider key is read per run from
swarm/services/review-classifier/acp-provider, which the bao UI's
admins login may create and update, and reaches opencode through
AcpRuntime::with_provider_key and the trampoline's allowlist.

Each ACP classification's cost is computed from the configured prices
and the reported tokens, and added to
hyperhive.review_classifier.cost.usage labelled repo, pr, model and
currency.

Part of #5096

docs/swarm/services.md

@@ -271,13 +271,18 @@ identity: the host that runs the store has it, and a services host with the
 store elsewhere gets the classifier only once it holds a copy of the pair (see
 below). Set `deploy.review-classifier.enable` directly to override either way.
 
-The operator writes the Anthropic key by hand, in the secret store's UI under
-the OIDC login, at
-`secret/swarm/services/review-classifier/anthropic-api-key`, field `api_key`.
-Nothing writes it for you: until it exists the service runs and every run fails
-with `no API key…`. The service reads the key on every run, so writing or
-removing it takes effect on the next run, with no restart. Every run spends
-money on that key.
+The operator writes the key of the runtime the swarm settings choose by hand,
+in the secret store's UI under the OIDC login, field `api_key`:
+
+- the API key runtime's Anthropic key at
+  `secret/swarm/services/review-classifier/anthropic-api-key`
+- the ACP runtime's provider key at
+  `secret/swarm/services/review-classifier/acp-provider`
+
+Nothing writes them for you: until the chosen one exists the service runs and
+every run fails with `no API key…` or `no ACP provider key…`. The service reads
+the key on every run, so writing or removing it takes effect on the next run,
+with no restart. Every run spends money on that key.
 
 It needs neither the forge nor a hive on its host. It reaches the queue and the
 secret store by name, under its own `review-classifier` leaf. On a host