docs(web-ui): facts + swarm-UI framing for operator day-to-day surfaces

docs/web-ui/README.md now frames itself as the per-hive dashboard (host
approvals, container state, rebuild queue) and points to swarm/ui.md for
swarm-wide day to day, matching the README's swarm-first reframe.

Credentials page fixes: it has only a GitHub PAT tab now (2c7e586f
removed the FORGES tab and moved external forge accounts to the swarm
UI; credentials.html never had a matrix tab).

hivectl/README.md: agents.rs has no create verb (hivectl-cli.md has no
'create' entry; agents.rs's create is swarm-level, swarmctl agent
create). forge.rs reconciles config, it doesn't provision an account;
matrix.rs/github.rs do agent-scoped invites/token writes; gateway.rs
manages the gateway's own htpasswd users — split out of the former
single 'per-integration account/token provisioning' line.

docs/web-ui/README.md

@@ -1,10 +1,13 @@
 # Dashboard & Web UI
 
-The operator-facing entry point for running a hive day to day. If you
-want implementation detail — wire formats, DOM structure, event
-plumbing — see [Dashboard layout](dashboard.md), [Per-agent
-page](agent.md), [Shape](shape.md), and [CSS theme variables](css-vars.md)
-below; this page only covers what you actually do here.
+The per-hive dashboard: approvals, container state and the rebuild
+queue for one hive. For swarm-wide day to day — the agent roster,
+creating agents, linking accounts — see
+[the swarm UI](../swarm/ui.md) instead. If you want implementation
+detail — wire formats, DOM structure, event plumbing — see [Dashboard
+layout](dashboard.md), [Per-agent page](agent.md), [Shape](shape.md),
+and [CSS theme variables](css-vars.md) below; this page only covers
+what you actually do here.
 
 ## Where things are
 
@@ -29,9 +32,11 @@ the whole swarm), **Logs** (`/logs.html`, per-agent and host
 journals), **Stats** (`/stats.html`, swarm-wide usage stats),
 **Builds** (`/builds.html`, the rebuild queue and build history),
 **Core** (`/core.html`, tombstones and container resource use), and
-**Credentials** (`/credentials.html`, provisioning GitHub/forge
-accounts per agent). Your local browser preferences (notifications)
-live in the dashboard's Y3R C4LL tab now, not a separate page.
+**Credentials** (`/credentials.html`, pasting a GitHub PAT for an
+agent's dedicated bot account — matrix and external-forge accounts are
+swarm identity now, linked from the swarm UI instead). Your local
+browser preferences (notifications) live in the dashboard's Y3R C4LL
+tab now, not a separate page.
 
 Each agent also has its own page — a full terminal view of that
 agent's session, reachable by selecting its name anywhere in the
@@ -79,9 +84,10 @@ journald view for any agent + service; the per-agent `⋮` menu's
 recurring or one-shot prompts you schedule for one or more agents, and
 reminders agents have set for themselves.
 
-**Provision an account for an agent.** The Credentials page covers
-Matrix, GitHub, and external-forge accounts per agent, without editing
-that agent's config repo.
+**Set an agent's GitHub token.** The Credentials page pastes a PAT for
+the agent's dedicated bot account, without editing that agent's config
+repo. Link matrix and external-forge accounts from the swarm UI
+instead.
 
 ## More depth
 

hivectl/README.md

@@ -2,7 +2,7 @@
 
 The operator-facing host CLI. A thin client for the `hive-c0re`
 daemon — speaks the host admin socket protocol (`hive-host-sock`) and
-does not link the daemon crate. Container lifecycle, the approval
+doesn't link the daemon crate. Container lifecycle, the approval
 queue, and provisioning verbs all forward to the daemon and need it
 running; a few (`wg`/`peer-config`, `choom`) work off local host state
 instead.
@@ -19,14 +19,19 @@ talk to the daemon over their own MCP tool surface
 One module per subcommand family; `main.rs` is just the clap parse +
 dispatch:
 
-- **`agents.rs`** — container lifecycle (start/stop/create/kill/rebuild/restart/…).
+- **`agents.rs`** — container lifecycle for an EXISTING agent
+  (start/stop/kill/rebuild/restart/…); creation is swarm-level
+  (`swarmctl agent create`).
 - **`approvals.rs`** — the config/spawn/meta-input approval queue.
 - **`dag_progress.rs`** — rebuild-queue progress rendering.
 - **`power.rs`** — restart/start/stop at the container level.
 - **`choom.rs`** — drop into an interactive claude session in a
   container.
-- **`forge.rs`**, **`matrix.rs`**, **`github.rs`**, **`gateway.rs`** —
-  per-integration account/token provisioning.
+- **`forge.rs`** — reconciles an agent's config against its forge
+  repo.
+- **`matrix.rs`**, **`github.rs`** — per-agent matrix invites and
+  GitHub PAT writes.
+- **`gateway.rs`** — gateway Basic-auth user management (htpasswd).
 - **`wg.rs`** — WireGuard mesh helpers.
 - **`subvol.rs`** — btrfs state-subvolume ops.
 - **`quota.rs`**, **`util.rs`**, **`completions.rs`**, **`open.rs`** —