github: PATs live in swarm bao; the agent fetches them itself

An operator links an agent's GitHub personal access token in the swarm UI
(LinkGithubAccountForm, "link github account" on /agents). swarm-controller's
PUT /api/hives/{hive}/agents/{agent}/github-account stores it at
swarm/agents/<agent>/github-token (swarm_secret_client::github), a flat leaf
under the agent's prefix that the agent's existing read grant already covers:
no policy change, and no list grant, since there is one token per agent.

In the agent, hive-agent-github-token (oneshot + 2-minute timer, as the agent
user, under its own store certificate, ordered before hive-github-notify)
reads that path and writes <state>/github-token, 0600 and agent-owned, the
file the gh wrapper, git credential helper and hive-github-notify already
read. It replaces the file by rename only when the bytes changed and never
deletes it: a hive-written github-token stays until a token is linked in the
swarm UI. It is installed only with a store address and
services.hyperhive.agent.github.enable.

Removed: the dashboard's CR3D3NTIALS page (credentials.html/js/css, its
build entries and H0M3 tile; GITHUB was its only tab), hive-c0re's
dashboard/matrix_accounts.rs with GET/POST /api/github-account,
priv_client::write_agent_github_token, the host socket's
SetAgentGithubToken and `hivectl github set-token`, and hive-priv's
WriteAgentGithubToken with write_agent_state_file, its only caller gone.

Docs: integrations/github.md and swarm/ui.md describe the swarm path,
swarm/credentials.md gains the store-path row, and the hive UI docs,
hivectl docs and security.md's hive-priv table drop the removed pieces.

Closes #4347

hive-c0re/src/dashboard/mod.rs

@@ -38,7 +38,6 @@ use crate::lifecycle;
         (name = "approvals", description = "approve/deny pending approval rows"),
         (name = "build_logs", description = "build log headers, full rows, and raw text downloads"),
         (name = "lifecycle_ops", description = "agent container lifecycle: rebuild/restart/start/stop/pause/limits"),
-        (name = "matrix_accounts", description = "github account provisioning for agents"),
         (name = "meta_inputs", description = "bulk flake-input update for the meta flake"),
         (name = "misc_api", description = "operator inbox, compose, spawn-request, hive stats"),
         (name = "permissions", description = "tool-group + capability assignment for agents"),
@@ -61,7 +60,6 @@ pub(crate) use hive_types::Ident;
 mod health;
 mod journal;
 mod lifecycle_ops;
-mod matrix_accounts;
 mod meta_inputs;
 mod misc_api;
 pub(crate) mod permissions;
@@ -126,8 +124,7 @@ pub async fn serve(
     // call below is therefore scoped to exactly one path — two handlers
     // in the same call only when they genuinely share a path with
     // different methods (`schedules::api_schedules`/`post_schedule_new`
-    // on `/api/schedules`, `matrix_accounts::get_github_account`/
-    // `post_github_account` on `/api/github-account`) — chained via
+    // on `/api/schedules`) — chained via
     // repeated `.routes(...)` calls instead of one giant `routes!(...)`
     // with everything in it.
     let (router, api) = OpenApiRouter::<AppState>::with_openapi(ApiDoc::openapi())
@@ -137,10 +134,6 @@ pub async fn serve(
         .routes(routes!(journal::get_journal_host))
         .routes(routes!(state_snapshot::api_state))
         .routes(routes!(state_files::get_state_file))
-        .routes(routes!(
-            matrix_accounts::post_github_account,
-            matrix_accounts::get_github_account
-        ))
         .routes(routes!(misc_api::api_operator_inbox))
         .routes(routes!(misc_api::api_stats_hive))
         .routes(routes!(misc_api::api_container_resources))
@@ -371,10 +364,6 @@ mod router_build_probe {
             .routes(routes!(journal::get_journal_host))
             .routes(routes!(state_snapshot::api_state))
             .routes(routes!(state_files::get_state_file))
-            .routes(routes!(
-                matrix_accounts::post_github_account,
-                matrix_accounts::get_github_account
-            ))
             .routes(routes!(misc_api::api_operator_inbox))
             .routes(routes!(misc_api::api_stats_hive))
             .routes(routes!(misc_api::api_container_resources))