github: PATs live in swarm bao; the agent fetches them itself

An operator links an agent's GitHub personal access token in the swarm UI
(LinkGithubAccountForm, "link github account" on /agents). swarm-controller's
PUT /api/hives/{hive}/agents/{agent}/github-account stores it at
swarm/agents/<agent>/github-token (swarm_secret_client::github), a flat leaf
under the agent's prefix that the agent's existing read grant already covers:
no policy change, and no list grant, since there is one token per agent.

In the agent, hive-agent-github-token (oneshot + 2-minute timer, as the agent
user, under its own store certificate, ordered before hive-github-notify)
reads that path and writes <state>/github-token, 0600 and agent-owned, the
file the gh wrapper, git credential helper and hive-github-notify already
read. It replaces the file by rename only when the bytes changed and never
deletes it: a hive-written github-token stays until a token is linked in the
swarm UI. It is installed only with a store address and
services.hyperhive.agent.github.enable.

Removed: the dashboard's CR3D3NTIALS page (credentials.html/js/css, its
build entries and H0M3 tile; GITHUB was its only tab), hive-c0re's
dashboard/matrix_accounts.rs with GET/POST /api/github-account,
priv_client::write_agent_github_token, the host socket's
SetAgentGithubToken and `hivectl github set-token`, and hive-priv's
WriteAgentGithubToken with write_agent_state_file, its only caller gone.

Docs: integrations/github.md and swarm/ui.md describe the swarm path,
swarm/credentials.md gains the store-path row, and the hive UI docs,
hivectl docs and security.md's hive-priv table drop the removed pieces.

Closes #4347

hivectl/src/cli.rs

@@ -45,15 +45,6 @@ pub enum Cmd {
         #[command(subcommand)]
         cmd: MatrixCmd,
     },
-    /// GitHub account provisioning.
-    ///
-    /// Store an operator-supplied personal access token (PAT) for an agent
-    /// so its `gh` and git can authenticate. Creates no account — the PAT
-    /// is for an existing GitHub account.
-    Github {
-        #[command(subcommand)]
-        cmd: GithubCmd,
-    },
     /// Gateway htpasswd user management.
     ///
     /// Add, remove, or list users for the gateway's HTTP Basic auth.
@@ -299,26 +290,6 @@ pub enum MatrixCmd {
     },
 }
 
-#[derive(Subcommand)]
-pub enum GithubCmd {
-    /// Store a GitHub PAT for `<agent>` so its `gh` and git can
-    /// authenticate.
-    ///
-    /// Prefer `--token-stdin` — an inline `--token` is visible in shell
-    /// history.
-    SetToken {
-        /// Logical agent name (the container/agent name).
-        agent: String,
-        /// The PAT value inline. Mutually exclusive with `--token-stdin`.
-        #[arg(long)]
-        token: Option<String>,
-        /// Read the PAT from stdin (trailing newline stripped). Mutually
-        /// exclusive with `--token`.
-        #[arg(long, conflicts_with = "token")]
-        token_stdin: bool,
-    },
-}
-
 #[derive(Subcommand)]
 pub enum GatewayCmd {
     /// Add a user or update an existing user's password in the gateway