archetypes: prefill the create form from flake-declared agent archetypes

A flake declares agent archetypes in its `hyperhiveArchetypes` output,
`<name> = { module; meta; }`. The hyperhive flake ships `reviewer`
(default permissions without `execution`).

swarm-builder answers `$SWARM.builder.archetypes` with the `meta` of
every archetype its own hyperhive source declares. swarm-controller asks
once the queue connects and every 10 minutes, checks each archetype as
`POST /api/agents` checks its settings, and stores the result in the
`agent-archetypes` KV bucket when it changed. `GET /api/archetypes`
serves it, and the create form's archetype select prefills permissions,
resource caps and inference from it.

The agent created is an ordinary agent with its own config repo; the
archetype's module is not applied yet.

Refs #5386

swarm-builder/README.md

@@ -31,3 +31,11 @@ read-only forge token at every build.
 environment, never in a URL or an argument, and the helper answers only an
 `https` request for the forge's host. Its store role reads exactly
 those two paths.
+
+## Archetypes
+
+The service also answers archetype evaluations: `nix eval` of the `meta` of
+every `hyperhiveArchetypes` entry in this host's hyperhive source, with
+nixpkgs pointed at this host's. It fetches nothing and uses no token, and it
+doesn't wait for a running build. See
+[`docs/swarm/archetypes.md`](../docs/swarm/archetypes.md).