forge: external forge accounts live in swarm bao; the agent fetches them itself

An operator now links an agent's external forge account (label, base URL,
token) in the swarm UI. swarm-controller stores it at
swarm/agents/<agent>/forge/<label>. There is no index: the store's
listing of the agent's forge/ directory is the set of accounts.

In the agent, hive-agent-forge-accounts (oneshot + 2-minute timer, as
the agent user, under its own store certificate) lists
swarm/agents/<agent>/forge/ with the `list` #4866 grants an agent on its
own metadata subtree, reads each account, and writes
<state>/forge-<label>-token and forge-<label>.json in the names and shape
hive-forge -f already reads. An empty listing (a 404, which `bao kv list
-format=json` answers with `{}` and an empty stderr) is zero accounts; a
denial or an unreachable store fails the unit. It never deletes: files
for labels not listed, including ones the hive wrote, stay as they are.

Removed: the dashboard FORGES tab (credentials.js/html section and its
CSS), hive-c0re's extra_forges.rs and its routes, priv_client's
extra-forge calls, and hive-priv's WriteAgentExtraForgeAccount /
DeleteAgentExtraForgeAccount with their helpers. The GITHUB tab and
WriteAgentGithubToken stay.

Also: persistence.md's matrix avatar note names the exit-75 restart on a
changed account listing, not the dashboard, as what brings a linked
account up.

Refs #4348

frontend/packages/swarm-ui/src/pages/LinkForgeAccountForm.tsx

@@ -0,0 +1,128 @@
+// <LinkForgeAccountForm> — writes an external forge account (base URL +
+// token) for one agent into the swarm secret store.
+// PUTs `/api/hives/{hive}/agents/{agent}/forge-accounts/{label}` — 200
+// (`{ url }`) on success, 400/500 as `problem+json`, shown via
+// `ApiErrorPanel` like `LinkMatrixAccountForm`.
+//
+// The label is what the agent passes to `hive-forge -f <label>`. A blind
+// set/update: no route lists linked accounts, and none hands a token back.
+import { useState } from "preact/hooks";
+import { ApiErrorPanel } from "@hive/shared/api-error-panel.js";
+import { readApiError, type ProblemDetails } from "@hive/shared/api-error.js";
+import { Panel } from "../ui/panel/Panel.js";
+import { TextField } from "../ui/text-field/TextField.js";
+import { Button } from "../ui/button/Button.js";
+import "./LinkMatrixAccountForm.css";
+
+// `hive_types::Ident`, which the server checks: `hive-forge -f` accepts
+// nothing wider. A UX hint only; the server is the gate.
+const LABEL_PATTERN = "[a-z0-9\\-]{1,63}";
+
+type SubmitState =
+  | { status: "idle" }
+  | { status: "submitting" }
+  | { status: "done"; url: string }
+  | { status: "error"; problem: ProblemDetails };
+
+export function LinkForgeAccountForm({
+  hive,
+  agent,
+  onClose,
+}: {
+  hive: string;
+  agent: string;
+  onClose?: () => void;
+}) {
+  const [label, setLabel] = useState("");
+  const [url, setUrl] = useState("");
+  const [token, setToken] = useState("");
+  const [result, setResult] = useState<SubmitState>({ status: "idle" });
+
+  async function submit(e: Event) {
+    e.preventDefault();
+    setResult({ status: "submitting" });
+    try {
+      const r = await fetch(
+        `/api/hives/${encodeURIComponent(hive)}/agents/${encodeURIComponent(agent)}/forge-accounts/${encodeURIComponent(label)}`,
+        {
+          method: "PUT",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ url: url.trim(), token }),
+        },
+      );
+      if (!r.ok) {
+        setResult({ status: "error", problem: await readApiError(r) });
+        return;
+      }
+      const body = (await r.json().catch(() => ({}))) as { url?: string };
+      setResult({ status: "done", url: body.url ?? url.trim() });
+      // The store holds the token now; nothing here needs it.
+      setToken("");
+    } catch (err) {
+      setResult({ status: "error", problem: { detail: String(err) } });
+    }
+  }
+
+  return (
+    <Panel
+      title={`link a forge account — ${agent}`}
+      icon="🔗"
+      onClose={onClose}
+    >
+      <p>
+        Writes the account to the swarm secret store. The agent fetches it
+        within two minutes and can then use{" "}
+        <code>hive-forge -f {label || "<label>"}</code>. Create the token on the
+        external forge first; nothing is created there.
+      </p>
+      <form class="link-matrix-account-form" onSubmit={submit}>
+        <TextField
+          id="forge-account-label"
+          label="label"
+          value={label}
+          pattern={LABEL_PATTERN}
+          title="1-63 chars: lowercase letters, digits, hyphen"
+          placeholder="e.g. codeberg"
+          required
+          onInput={setLabel}
+        />
+        <TextField
+          id="forge-account-url"
+          label="forge URL"
+          type="url"
+          value={url}
+          placeholder="https://codeberg.org"
+          required
+          onInput={setUrl}
+        />
+        <TextField
+          id="forge-account-token"
+          label="access token"
+          type="password"
+          value={token}
+          required
+          onInput={setToken}
+        />
+        <Button
+          variant="primary"
+          type="submit"
+          disabled={result.status === "submitting"}
+        >
+          {result.status === "submitting" ? "linking…" : "link account"}
+        </Button>
+      </form>
+      {result.status === "done" && (
+        <p class="link-matrix-account-result-ok">
+          linked <strong>{label}</strong> ({result.url}) to{" "}
+          <strong>{agent}</strong>
+        </p>
+      )}
+      {result.status === "error" && (
+        <ApiErrorPanel
+          context="failed to link the account"
+          problem={result.problem}
+        />
+      )}
+    </Panel>
+  );
+}

frontend/packages/swarm-ui/src/pages/agents/AgentsPage.tsx

@@ -48,6 +48,7 @@ import { SplitView } from "../../ui/split-view/SplitView.js";
 import { type TableColumn } from "../../ui/table/Table.js";
 import { CreateAgentForm } from "../CreateAgentForm.js";
 import { LinkMatrixAccountForm } from "../LinkMatrixAccountForm.js";
+import { LinkForgeAccountForm } from "../LinkForgeAccountForm.js";
 import { WantedMenu } from "./WantedMenu.js";
 import "./AgentsPage.css";
 
@@ -152,6 +153,8 @@ export function AgentsPage() {
   // confirmation of a `declareState` call, it's an unrelated action with
   // its own form (`LinkMatrixAccountForm`).
   const [matrixTarget, setMatrixTarget] = useState<AgentRow | null>(null);
+  // The row showing the "link a forge account" dialog, same shape.
+  const [forgeTarget, setForgeTarget] = useState<AgentRow | null>(null);
   // Which agent the detail panel shows, *by name* — not the `AgentRow`
   // object itself. Storing the row would snapshot it at selection time;
   // `rows` replaces its whole array on every `refresh()` and every
@@ -581,6 +584,22 @@ export function AgentsPage() {
                         : "no hive on record for this agent — nothing to link against"
                     }
                   />
+                  <Badge
+                    variant="quiet"
+                    icon={<LinkIcon />}
+                    value="link forge account"
+                    onClick={
+                      detailTarget.hive
+                        ? () => setForgeTarget(detailTarget)
+                        : undefined
+                    }
+                    disabled={!detailTarget.hive}
+                    title={
+                      detailTarget.hive
+                        ? `link an external forge account to ${detailTarget.name}`
+                        : "no hive on record for this agent — nothing to link against"
+                    }
+                  />
                 </div>
                 {/* MVP scope per mara's own ruling: a small read-only
                     preview, no header/no input — the full terminal
@@ -618,6 +637,20 @@ export function AgentsPage() {
           />
         ) : null}
       </Dialog>
+      <Dialog
+        open={forgeTarget !== null}
+        onClose={() => setForgeTarget(null)}
+        label="link a forge account"
+        plain
+      >
+        {forgeTarget?.hive ? (
+          <LinkForgeAccountForm
+            hive={forgeTarget.hive}
+            agent={forgeTarget.name}
+            onClose={() => setForgeTarget(null)}
+          />
+        ) : null}
+      </Dialog>
       <ConfirmDialog
         open={confirmTarget !== null}
         label={confirmTarget ? CONFIRM_COPY[confirmTarget.state].label : ""}