swarm-controller: refuse linking over an existing account

The matrix, forge and github link routes wrote their credential
unconditionally, so linking a name that was already linked replaced the
working account. For matrix that lost the device the agent's crypto store
belongs to (#4838).

Each route now reads the account's store path first and answers 409,
naming the existing account, when something is stored there. Nothing is
written. Replacing an account takes the delete from #4899, then a link.

The matrix route checks before password mode's login, so a refused link
mints no new device at the homeserver.

The check is a read then a write, not an atomic step; two concurrent
links to one name can still both pass it.

Closes #4856

frontend/packages/swarm-ui/src/pages/LinkGithubAccountForm.tsx

@@ -1,10 +1,10 @@
 // <LinkGithubAccountForm> — writes a GitHub personal access token for one
 // agent into the swarm secret store.
 // PUTs `/api/hives/{hive}/agents/{agent}/github-account` — 204 on success,
-// 400/500 as `problem+json`, shown via `ApiErrorPanel` like
+// 400/409/500 as `problem+json`, shown via `ApiErrorPanel` like
 // `LinkForgeAccountForm`.
 //
-// One token per agent. A blind set/update: no route hands a token back.
+// One token per agent. A blind set: no route hands a token back.
 // Whether one is stored shows on the agent panel (`LinkedAccounts`).
 import { useState } from "preact/hooks";
 import { ApiErrorPanel } from "@hive/shared/api-error-panel.js";