swarm UI: send a message to an agent, without its hive

The agent view in the swarm UI gets a message box. The text reaches the
agent's harness straight from swarm-controller over the swarm queue and
becomes an inbox turn from the operator's authelia username. hive-c0re is
not in the path.

- gateway: `/api/` forwards authelia's `Remote-User`, replacing any the
  client sent.
- swarm-controller: `POST /api/agents/{name}/input` takes that header as
  the sender (401 without it) and sends `{from, body}` as a NATS request
  on `$SWARM.input.<agent>`. No subscriber is a 503.
- swarm-nats-auth: the controller is granted publish on `$SWARM.input.*`;
  no hive or agent grant names the family, so the harness can trust
  `from`.
- hive-agent: a task subscribes to the agent's own input subject and
  pushes each message into the serve loop's existing reminder channel,
  renamed `local_msg_*` since it now carries both.

The harness does not reply to the request: no agent grant covers a reply
subject. The controller therefore answers 202 once the request times out
(2s) and 503 on the server's no-responders status.

Closes #4828

frontend/packages/swarm-ui/src/pages/agents/AgentTerminalPage.tsx

@@ -1,10 +1,8 @@
 // <AgentTerminalPage> — the swarm terminal tab's full page, mounted at
 // `/agents/:name/terminal`. The MVP `AgentTermPreview` (below `AgentsPage`'s
-// detail panel) is explicitly capped and read-only; this is that same
+// detail panel) is height-capped; this is that same
 // component's `fullHeight` mount — no 12em cap, floating header badges
-// shown (there's no detail-panel `<dl>` here to duplicate them). Sending
-// input back to the agent is still explicit follow-up scope, same as the
-// preview's own file comment says — this page doesn't change that.
+// shown (there's no detail-panel `<dl>` here to duplicate them).
 //
 // Registers itself in the dynamic-tabs row on mount (not just when opened
 // via the preview's expand trigger) — a bookmark, a shared link, or a