docs: document model/context-window config, dynamic watermarks, rate-limit scoping

CLAUDE.md

@@ -139,11 +139,14 @@ hive-sh4re/        wire types (HostRequest/Response, AgentRequest/Response,
 
 nix/
   modules/hive-c0re.nix         systemd service + firewall + git wiring;
+                                 `contextWindowTokens` attrset (per-model,
+                                 injected as env vars into all containers);
                                  imports hive-forge.nix
   modules/hive-forge.nix        optional in-container Forgejo
                                  (`hyperhive.forge.enable`, default on);
                                  Catppuccin Mocha theme via tmpfiles C+ copy
-  templates/harness-base.nix    shared scaffolding for sub-agents + manager
+  templates/harness-base.nix    shared scaffolding for sub-agents + manager;
+                                 `hyperhive.model` option (HIVE_DEFAULT_MODEL)
   templates/agent-base.nix      sub-agent nixosConfiguration
   templates/manager.nix         manager nixosConfiguration
   templates/weston-vnc.nix      optional `hyperhive.gui.enable`
@@ -205,3 +208,7 @@ read them à la carte.
 - **Rate-limit sentinel:** `{state_dir}/hyperhive-rate-limited`
   is written by the harness on 429 and cleared on retry.
   `ContainerView.rate_limited` reads it for the dashboard badge.
+- **Context window:** defaults are in `services.hive-c0re.contextWindowTokens`
+  (host nix, affects all agents). Per-agent default model via
+  `hyperhive.model` in `agent.nix`. Watermarks are 75%/50% of the
+  effective window.