refactor(hivectl): move quota + subvol under agents

Both groups only ever act on a single managed agent's state dir, so
they belong in the `agents` namespace rather than as top-level verbs
next to `forge` / `matrix` / `wg`.

Renames `quota limit` -> `quota set`: the enclosing group already
carries the noun, so the bare verb matches the flat `set-parent` /
`set-limits` spelling without stuttering, and it removes the
`set-limits` (cpu/mem) vs `quota limit` (disk) ambiguity. Adds a
cross-pointer from `set-limits` to `agents quota`.

Handlers stay in their own modules; `run_agents` gains the reparenting
glue. Regenerates docs/tools/hivectl-cli.md.

Refs #2724

hive-priv/src/main.rs

@@ -1178,7 +1178,7 @@ async fn snapshot_agent_subvolume(
     let agent_root = PathBuf::from(AGENT_STATE_ROOT).join(agent_name);
     if !is_btrfs_subvolume(&agent_root) {
         bail!(
-            "{} is not a btrfs subvolume — nothing to snapshot (run `hivectl subvol upgrade` first)",
+            "{} is not a btrfs subvolume — nothing to snapshot (run `hivectl agents subvol upgrade` first)",
             agent_root.display()
         );
     }