matrix: provision per-agent accounts on startup via UIAA registration (#548 phase 2)

CLAUDE.md

@@ -107,6 +107,15 @@ hive-c0re/         host daemon + CLI (one binary, subcommand-dispatched)
                          and meta read access; mirrors each applied repo
                          into `agent-configs/<n>` (core-only); agents are
                          read-only collaborators on `core/meta`
+  src/matrix.rs         optional matrix-tuwunel wiring: generates the
+                         shared registration token at
+                         `/var/lib/hyperhive/matrix-register-token`,
+                         provisions per-agent matrix accounts via the
+                         matrix-spec UIAA two-leg registration flow,
+                         persists each agent's access_token to
+                         `<state>/matrix-token`. Idempotent — skips
+                         registration when token file already exists.
+                         No-op when `hive-matrix` container absent (#548).
   src/dashboard.rs      axum HTTP: /api/state JSON + actions
                          + journald viewer + bind-with-retry (SO_REUSEADDR)
                          + deployed_sha chip per container +