dashboard: matrix-accounts page — provision/login per-agent external matrix accounts

New standalone H0M3 page (/matrix-accounts.html) and tile. An agent
picker drives a list of that agent's configured matrix accounts (name,
homeserver, token-stored status) and a provision form that logs in by
password or stores an existing token.

Frontend half of the per-agent external matrix-account provisioning
work. Built against the v1 backend contract:
  GET  /matrix-accounts?agent=<name>
       -> { accounts: [ { name, homeserver, token_present } ] }
  POST /matrix-account-login  (x-www-form-urlencoded, operator-auth)
       fields: agent, account, homeserver, mode=password|token,
               user_id?, password?, token?
       -> 2xx { ok, user_id } | 4xx { error }

The token is never echoed back; secret inputs are cleared on submit.
Token-status dot reflects token-stored, not live session (a true
up/down indicator needs the daemon account registry, a follow-up). The
form carries an experimental notice pending per-account failure
isolation on the matrix daemon.

Blocked from merge on the backend endpoints and the daemon
failure-isolation fix; opening for review + to pin the UI/backend wire
contract.

frontend/packages/dashboard/src/index.html

@@ -76,6 +76,14 @@
         <span class="home-tile-desc">rebuild queue · meta inputs · kept state · container load</span>
       </a>
 
+      <a class="home-tile" href="/matrix-accounts.html">
+        <span class="home-tile-head">
+          <span class="home-tile-icon" aria-hidden="true">🔑</span>
+          <span class="home-tile-label">Matrix accounts</span>
+        </span>
+        <span class="home-tile-desc">provision · log in · store per-agent matrix tokens</span>
+      </a>
+
       <!-- Forge tile: hidden until home.js confirms the hive-forge
            container is up (state.forge_present); home.js also fills the
            href from state.forge_public_url (or the :3000 fallback), so