forge: external forge accounts live in swarm bao; the agent fetches them itself

An operator now links an agent's external forge account (label, base URL,
token) in the swarm UI. swarm-controller stores it at
swarm/agents/<agent>/forge/<label>. There is no index: the store's
listing of the agent's forge/ directory is the set of accounts.

In the agent, hive-agent-forge-accounts (oneshot + 2-minute timer, as
the agent user, under its own store certificate) lists
swarm/agents/<agent>/forge/ with the `list` #4866 grants an agent on its
own metadata subtree, reads each account, and writes
<state>/forge-<label>-token and forge-<label>.json in the names and shape
hive-forge -f already reads. An empty listing (a 404, which `bao kv list
-format=json` answers with `{}` and an empty stderr) is zero accounts; a
denial or an unreachable store fails the unit. It never deletes: files
for labels not listed, including ones the hive wrote, stay as they are.

Removed: the dashboard FORGES tab (credentials.js/html section and its
CSS), hive-c0re's extra_forges.rs and its routes, priv_client's
extra-forge calls, and hive-priv's WriteAgentExtraForgeAccount /
DeleteAgentExtraForgeAccount with their helpers. The GITHUB tab and
WriteAgentGithubToken stay.

Also: persistence.md's matrix avatar note names the exit-75 restart on a
changed account listing, not the dashboard, as what brings a linked
account up.

Refs #4348

frontend/packages/dashboard/src/credentials.html

@@ -12,7 +12,7 @@
   </head>
   <body class="cred-shell">
     <!-- Minimal chrome: back link + sub-tab strip, same pattern as
-       logs.html (GITHUB / FORGES instead of AGENT/INFRA/SYSTEM). Back
+       logs.html (GITHUB instead of AGENT/INFRA/SYSTEM). Back
        link points to the H0M3 hub (served at /). -->
     <header class="page-header">
       <a class="page-back" href="/">← home</a>
@@ -25,8 +25,7 @@
     </header>
 
     <main class="cred-main">
-      <!-- Agent picker: shared across the tabs (one agent selected at a
-         time drives both the github status and the forge list). -->
+      <!-- Agent picker: the selected agent drives the github status. -->
       <h3>◇ agent</h3>
       <label class="ma-field">
         <span>agent</span>
@@ -81,61 +80,6 @@
           <p id="gh-result" class="ma-result" aria-live="polite"></p>
         </form>
       </section>
-
-      <!-- FORGES tab: external Forgejo/Gitea/Codeberg-compatible forges.
-         Entirely dashboard-provisioned, no host-side nix config &mdash; same
-         shape as GITHUB plus a base-URL field.
-         The operator creates a token on the external forge themselves
-         (however that forge lets them) and pastes label + URL + token
-         below. No remote account minting/revoking &mdash; purely local. -->
-      <section
-        class="cred-pane"
-        id="cred-pane-forges"
-        data-tab-pane="forges"
-        role="tabpanel"
-        aria-labelledby="cred-tab-forges"
-        hidden
-      >
-        <p class="meta">
-          store a <strong>label + base URL + access token</strong> for an
-          external Forgejo/Gitea/Codeberg-compatible forge, per agent. no
-          account is created on the remote forge &mdash; create the token there
-          yourself first. the token is never displayed back on this page.
-        </p>
-
-        <h3>◇ provisioned forges</h3>
-        <div id="ef-list" class="ef-list">
-          <p class="meta">select an agent to see its forge accounts.</p>
-        </div>
-
-        <h3>◇ add forge account</h3>
-        <form id="ef-form" class="ma-form" autocomplete="off">
-          <label class="ma-field">
-            <span>label</span>
-            <input
-              type="text"
-              name="label"
-              placeholder="e.g. codeberg"
-              required
-            />
-          </label>
-          <label class="ma-field">
-            <span>base url</span>
-            <input
-              type="text"
-              name="base_url"
-              placeholder="https://codeberg.org"
-              required
-            />
-          </label>
-          <label class="ma-field">
-            <span>access token</span>
-            <input type="password" name="token" autocomplete="off" required />
-          </label>
-          <button type="submit" class="btn btn-spawn">store account</button>
-          <p id="ef-result" class="ma-result" aria-live="polite"></p>
-        </form>
-      </section>
     </main>
 
     <script type="module" src="/static/credentials.js" defer></script>