feat: rename matrix-accounts page to credentials, add github PAT tab

Part 2 of hyperhive#1970 (backend/CLI landed in PR #2378). Renames
/matrix-accounts.html -> /credentials.html and restructures it with a
sub-tab strip (MATRIX / GITHUB), reusing the shared @hive/shared/tabs.js
tab strip already used by /logs.html.

MATRIX tab carries over the existing account list + login form
unchanged. GITHUB tab adds a single-PAT provisioning form: status line
(present/absent, read from GET /api/github-account), a security-warning
banner (dedicated bot account + minimally-scoped token), a link to
generate a PAT at github.com/settings/tokens, and a paste-token form
posting to POST /api/github-account. Both tabs share one agent picker.

Updated docs/web-ui.md + docs/web-ui/dashboard.md to describe the new
page shape, and the H0M3 hub tile (index.html) to point at the renamed
page.

docs/web-ui.md

@@ -15,7 +15,7 @@ This doc has been split for readability. Pick the section you need:
 - **[Dashboard layout](web-ui/dashboard.md)** — tab contents
   (SW4RM, Y3R C4LL, P3RM1SS10NS, SCH3DUL3S) + standalone pages
   (C0R3 `/core.html`, BU1LDS `/builds.html`, L0GS `/logs.html`,
-  M4TR1X ACC0UNTS `/matrix-accounts.html`), container row,
+  CR3D3NTIALS `/credentials.html`), container row,
   topology tree, selection bar, approval card, browser
   notifications, dashboard endpoints + event channel.
 - **[Per-agent page](web-ui/agent.md)** — header, main terminal,

docs/web-ui/dashboard.md

@@ -254,15 +254,22 @@ badge with a ticking elapsed-time chip; expanding streams output via
 (suspends on manual scroll-up). Deep-link: `?id=N#buildlogs` opens the
 entry with that id pre-expanded.
 
-## M4TR1X ACC0UNTS page (`/matrix-accounts.html`)
+## CR3D3NTIALS page (`/credentials.html`)
 
-Operator surface to provision / log in a per-agent **external** matrix
-account and store its access token, without editing the agent's config
-repo. Standalone page reached from the **Matrix accounts** tile on the
-H0M3 hub, same minimal chrome as `/core.html` (a `← home` back-link +
-title). Its own esbuild bundle (`matrix-accounts.js`); no SSE — it reads
-`/api/state` once for the agent picker and otherwise works off two
-purpose-built endpoints.
+Operator surface to provision per-agent credentials without editing the
+agent's config repo. Standalone page reached from the **Credentials** tile
+on the H0M3 hub, same minimal chrome as `/logs.html` (a `← home` back-link
++ a sub-tab strip, via the shared `@hive/shared/tabs.js` tab strip) rather
+than `/core.html`'s plain title. Its own esbuild bundle
+(`credentials.js`); no SSE — it reads `/api/state` once for the (shared)
+agent picker and otherwise works off purpose-built endpoints per tab.
+Two sub-tabs:
+
+### MATRIX tab
+
+Provision / log in a per-agent **external** matrix account and store its
+access token (this half is unchanged from the old `/matrix-accounts.html`
+page it replaces — only the URL and surrounding chrome moved).
 
 An agent picker (populated from `state.containers`, the live roster) drives a list of that
 agent's accounts — name, homeserver, user id, and a status dot —
@@ -288,6 +295,24 @@ The status dot renders these states:
   !live` "provisioned but offline" case.
 - **grey** — no token (not provisioned).
 
+### GITHUB tab
+
+Provision a single per-agent GitHub personal access token (see
+[`docs/github.md`](../github.md) for the injection + `gh`/git-push
+mechanics). No login flow — the operator pastes an existing PAT for a
+dedicated bot account, with a security-warning banner (dedicated account +
+minimally-scoped token) and a link to
+[github.com/settings/tokens](https://github.com/settings/tokens).
+
+Status reads `GET /api/github-account?agent=<name>` →
+`{ present: bool }` — whether the agent's `github-token` file exists.
+There's no live/heartbeat concept for a static PAT, so this is just a
+"token stored ✓" / "not set" line, unlike MATRIX's status-dot taxonomy.
+Provisioning posts `POST /api/github-account` (form-encoded `agent`,
+`token`) → `200 { ok: true }` on success, or the same `error_response`
+shape `/api/matrix-account-login` uses on failure. The token is never
+echoed back in either direction.
+
 The container-down cross-reference (`/api/state`) takes precedence over
 the age check. `as_of_unix` is tooltipped ("live as of N ago") throughout
 so freshness is always legible. When `live` is absent (an older backend