docs(web-ui): facts + swarm-UI framing for operator day-to-day surfaces

docs/web-ui/README.md now frames itself as the per-hive dashboard (host
approvals, container state, rebuild queue) and points to swarm/ui.md for
swarm-wide day to day, matching the README's swarm-first reframe.

Credentials page fixes: it has only a GitHub PAT tab now (2c7e586f
removed the FORGES tab and moved external forge accounts to the swarm
UI; credentials.html never had a matrix tab).

hivectl/README.md: agents.rs has no create verb (hivectl-cli.md has no
'create' entry; agents.rs's create is swarm-level, swarmctl agent
create). forge.rs reconciles config, it doesn't provision an account;
matrix.rs/github.rs do agent-scoped invites/token writes; gateway.rs
manages the gateway's own htpasswd users — split out of the former
single 'per-integration account/token provisioning' line.

hivectl/README.md

@@ -2,7 +2,7 @@
 
 The operator-facing host CLI. A thin client for the `hive-c0re`
 daemon — speaks the host admin socket protocol (`hive-host-sock`) and
-does not link the daemon crate. Container lifecycle, the approval
+doesn't link the daemon crate. Container lifecycle, the approval
 queue, and provisioning verbs all forward to the daemon and need it
 running; a few (`wg`/`peer-config`, `choom`) work off local host state
 instead.
@@ -19,14 +19,19 @@ talk to the daemon over their own MCP tool surface
 One module per subcommand family; `main.rs` is just the clap parse +
 dispatch:
 
-- **`agents.rs`** — container lifecycle (start/stop/create/kill/rebuild/restart/…).
+- **`agents.rs`** — container lifecycle for an EXISTING agent
+  (start/stop/kill/rebuild/restart/…); creation is swarm-level
+  (`swarmctl agent create`).
 - **`approvals.rs`** — the config/spawn/meta-input approval queue.
 - **`dag_progress.rs`** — rebuild-queue progress rendering.
 - **`power.rs`** — restart/start/stop at the container level.
 - **`choom.rs`** — drop into an interactive claude session in a
   container.
-- **`forge.rs`**, **`matrix.rs`**, **`github.rs`**, **`gateway.rs`** —
-  per-integration account/token provisioning.
+- **`forge.rs`** — reconciles an agent's config against its forge
+  repo.
+- **`matrix.rs`**, **`github.rs`** — per-agent matrix invites and
+  GitHub PAT writes.
+- **`gateway.rs`** — gateway Basic-auth user management (htpasswd).
 - **`wg.rs`** — WireGuard mesh helpers.
 - **`subvol.rs`** — btrfs state-subvolume ops.
 - **`quota.rs`**, **`util.rs`**, **`completions.rs`**, **`open.rs`** —