agents: remove the hive-level /model control; the swarm editor sets the model

The per-agent web UI no longer sets the model: the `/model` slash
command, the model picker, `POST /api/model`, `Bus::set_model` and the
`hyperhive-model` writer are gone. The model chip is display-only and
shows where the model comes from (`model_source` in `/api/state`). The
model is set on the swarm (swarm UI agents page, `swarmctl agent
inference set`).

The read side is unchanged: with no swarm value an agent runs its
agent.nix model, else an existing `hyperhive-model` file, else haiku.
Existing files are not touched.

With the picker gone, its model list goes too: `available_models` in
`/api/state`, the ACP model-list filter, and the harness's global
`HIVE_AVAILABLE_MODELS`. The subagent daemon keeps its own
`HIVE_AVAILABLE_MODELS` from mcp.nix, and the `availableModels`
assertion stays.

`/effort` (command, picker, route, file) is unchanged.

Refs #5034

docs/web-ui/agent.md

@@ -47,15 +47,18 @@ at a given viewport width. Two columns:
     `◌ needs login` / `◌ logging in` / `○ offline` / `… connecting`.
   - **State badge**: `💤 idle` / `🧠 thinking` / `📦 compacting` /
     `○ offline` / `… booting` + age suffix.
-  - **Model badge** (`model · <name> ▾`): a real picker — selecting it opens
-    a `Dropdown` of `state.available_models`, selecting one POSTs
-    `/api/model` immediately (same endpoint the `/model <name>` slash
-    command uses). A header badge: the control and its display sit
-    together.
-  - **Effort badge** (`effort · <level> ▾`): same shape, `/api/effort`,
-    shown when `state.available_efforts` is non-empty.
-  - On an ACP agent both pickers list what its session offers (its
-    `model` and `thought_level` config options), and are empty until the
+  - **Model badge** (`model · <name>`): display only. Its tooltip says where
+    the model comes from (`state.model_source`: set on the swarm, agent.nix,
+    an existing `hyperhive-model` file, or the built-in default) and what the
+    last turn resolved it to. The model is set on the swarm: the swarm UI's
+    agents page, or `swarmctl agent inference set`
+    ([`inference.md`](../swarm/inference.md)).
+  - **Effort badge** (`effort · <level> ▾`): a real picker — selecting it
+    opens a `Dropdown` of `state.available_efforts` and POSTs `/api/effort`
+    immediately. Shown when `state.available_efforts` is non-empty.
+  - On an ACP agent the model badge shows the session's own model when it
+    doesn't offer the requested one, and the effort picker lists the levels
+    its session offers (its `thought_level` config option), empty until the
     first turn has attached a session. The effort picker is hidden when the
     model offers no effort levels, and while a newly picked model waits for
     the next turn, since the levels come with the model.
@@ -82,8 +85,8 @@ at a given viewport width. Two columns:
     (`GET /api/state`'s `links` field) also feeds
     `DashboardState.links` for the dashboard card's icon strip —
     `agent_links()` in hive-agent is the single source of truth for
-    both. The dashboard link lives in this 🔗 popover; the model/effort
-    pickers are real badges above; and `/new-session` / `/logout` are
+    both. The dashboard link lives in this 🔗 popover; the effort picker
+    is a real badge above; and `/new-session` / `/logout` are
     typed slash commands with their own type-twice confirm (see
     below).
   - `/cancel` (slash command, below) is the only cancel-turn path; the
@@ -234,10 +237,6 @@ Slash commands today:
   runs the `/compact` at the next turn boundary (end of the in-flight
   turn, or `turn::run_pending_compact` when idle); output streams into
   the live panel. Works mid-turn, not only when idle.
-- `/model <name>` — `POST /api/model` flipping `Bus::set_model`.
-  Takes effect on the next turn; persisted to
-  `/state/hyperhive-model` so the override survives harness
-  restart / rebuild.
 - `/effort <level>` — `POST /api/effort` setting the claude effort
   level (`low` / `medium` / `high` / `xhigh` / `max`). Takes effect on the next
   turn. `StatusChips`' effort badge calls the same endpoint; both stay
@@ -276,17 +275,15 @@ shaped).
   turn — only the stdin payload differs). Flips state to
   `Compacting` via `Bus::set_state`, which emits
   `TurnStateChanged`.
-- `POST /api/model` (`model=<name>`) — switch the model for
-  future turns. `Bus::set_model` emits `ModelChanged`.
 - `POST /api/effort` (`effort=<level>`) — switch the claude
   effort level for future sessions. Validated server-side against
   `EFFORT_LEVELS` (`low`/`medium`/`high`/`xhigh`/`max`) — unknown values are
   rejected rather than forwarded to `claude --effort`. Persists via
   `Bus::set_effort`, which emits `EffortChanged`. Applies on the next
   session start (no mid-session swap).
-- On an ACP agent, `/api/model` and `/api/effort` accept only values the
-  session offers, and the runtime sets them with `session/set_config_option`
-  before the next prompt.
+- On an ACP agent, `/api/effort` accepts only values the session offers,
+  and the runtime sets the level with `session/set_config_option` before
+  the next prompt.
 - `POST /api/new-session` — arm a one-shot for the next turn to
   drop `--continue`. Emits a `LiveEvent::Note`.
 - `POST /api/logout` — three-step teardown that re-uses the
@@ -320,7 +317,7 @@ shaped).
   the frontend (`useAgentState.ts`) on page load and, on a poll, while
   `status === 'needs_login_in_progress'`. Includes `turn_state`,
   `context_window_tokens`, `qualified_label`,
-  `available_models`, `effort`, `available_efforts`, `links`, and
+  `model`, `model_source`, `effort`, `available_efforts`, `links`, and
   other fields described inline throughout this document. All
   subsequent state updates arrive via SSE.
 - `GET /api/dashboard-state` — lean snapshot of agent-owned fields
@@ -392,7 +389,8 @@ Bus events (new vocabulary on `/events/stream`):
   `needs_login_idle` / `needs_login_in_progress`. Drives the
   alive-badge. The harness sets `rate_limited` when it detects a
   429 response and clears it when the retry sleep expires.
-- `model_changed { model }` — drives the model chip.
+- `model_changed { model }` — drives the model chip. The harness emits it
+  when it applies or clears a swarm value.
 - `effort_changed { effort }` — drives the effort picker chip.
   Emitted from `Bus::set_effort` on `POST /api/effort`; applies on
   the next session start.