github: PATs live in swarm bao; the agent fetches them itself

An operator links an agent's GitHub personal access token in the swarm UI
(LinkGithubAccountForm, "link github account" on /agents). swarm-controller's
PUT /api/hives/{hive}/agents/{agent}/github-account stores it at
swarm/agents/<agent>/github-token (swarm_secret_client::github), a flat leaf
under the agent's prefix that the agent's existing read grant already covers:
no policy change, and no list grant, since there is one token per agent.

In the agent, hive-agent-github-token (oneshot + 2-minute timer, as the agent
user, under its own store certificate, ordered before hive-github-notify)
reads that path and writes <state>/github-token, 0600 and agent-owned, the
file the gh wrapper, git credential helper and hive-github-notify already
read. It replaces the file by rename only when the bytes changed and never
deletes it: a hive-written github-token stays until a token is linked in the
swarm UI. It is installed only with a store address and
services.hyperhive.agent.github.enable.

Removed: the dashboard's CR3D3NTIALS page (credentials.html/js/css, its
build entries and H0M3 tile; GITHUB was its only tab), hive-c0re's
dashboard/matrix_accounts.rs with GET/POST /api/github-account,
priv_client::write_agent_github_token, the host socket's
SetAgentGithubToken and `hivectl github set-token`, and hive-priv's
WriteAgentGithubToken with write_agent_state_file, its only caller gone.

Docs: integrations/github.md and swarm/ui.md describe the swarm path,
swarm/credentials.md gains the store-path row, and the hive UI docs,
hivectl docs and security.md's hive-priv table drop the removed pieces.

Closes #4347

docs/web-ui/dashboard.md

@@ -30,7 +30,7 @@ from the dashboard tab strip.
   — sits below the tab strip.
 - **Server-warnings banner** — a generic, sticky top-of-page strip shown
   on **every** page (dashboard + every stand-alone page — FL0W, L0GS,
-  H0M3, C0R3, BU1LDS, CR3D3NTIALS, ST4TS), injected at the top
+  H0M3, C0R3, BU1LDS, ST4TS), injected at the top
   of `<body>` by `renderServerWarnings` in `common.js`. Driven by
   `state.server_warnings` — a list of `{ kind, level, message }` — and
   coloured by `level` (`warn` amber / `crit` red). hive-c0re owns the
@@ -283,35 +283,6 @@ badge with a ticking elapsed-time chip; expanding streams output via
 (suspends on manual scroll-up). Deep-link: `?id=N#buildlogs` opens the
 entry with that id pre-expanded.
 
-## CR3D3NTIALS page (`/credentials.html`)
-
-Operator surface to provision per-agent credentials without editing the
-agent's config repo. Standalone page reached from the **Credentials** tile
-on the H0M3 hub, same minimal chrome as `/logs.html` (a `← home` back-link
-+ a sub-tab strip, via the shared `@hive/shared/tabs.js` tab strip) rather
-than `/core.html`'s plain title. Its own esbuild bundle
-(`credentials.js`); no SSE — it reads `/api/state` once for the (shared)
-agent picker and otherwise works off purpose-built endpoints per tab.
-One sub-tab, GITHUB.
-
-### GITHUB tab
-
-Provision a single per-agent GitHub personal access token (see
-[`docs/integrations/github.md`](../integrations/github.md) for the injection + `gh`/git-push
-mechanics). No login flow — the operator pastes an existing PAT for a
-dedicated bot account, with a security-warning banner (dedicated account +
-minimally scoped token) and a link to
-[github.com/settings/tokens](https://github.com/settings/tokens).
-
-Status reads `GET /api/github-account?agent=<name>` →
-`{ present: bool }` — whether the agent's `github-token` file exists.
-There's no live/heartbeat concept for a static PAT, so this is just a
-"token stored ✓" / "not set" line.
-Provisioning posts `POST /api/github-account` (form-encoded `agent`,
-`token`) → `200 { ok: true }` on success; failures come back as RFC 9457
-`application/problem+json` with the message in `detail`. The token is never
-echoed back in either direction.
-
 ## P3RM1SS10NS tab
 
 Per-agent permission configuration. Two sections, each rendered as a
@@ -575,7 +546,7 @@ re-renders the terminal row. The operator addresses the root agent as `@root`.
 
 The H0M3 hub is the primary landing page (served at `/` by default). A
 responsive grid of link tiles — Dashboard, Flow, Logs, Builds, Stats,
-Core, Credentials, API — each pointing to their respective
+Core, API — each pointing to their respective
 surfaces, all unconditionally shown (no gating). The page is a pure
 portal with no tab-bar or SSE subscriptions. Typography + colours inherit
 from the shared theme (Catppuccin Mocha via `common.css` + `theme.css`).