refactor(#2352): move matrix provisioning behind host-socket wire commands

hive-host-sock/src/lib.rs

@@ -94,6 +94,37 @@ pub enum HostRequest {
         #[serde(default)]
         scope: LifecycleScope,
     },
+    /// Create or refresh a matrix account + access token for `name`.
+    /// The daemon runs the provisioning (it holds the register + admin
+    /// tokens and the matrix creds dir) and returns the operator-facing
+    /// results (persisted-token path for agents, or the freshly-minted
+    /// token + password for non-agent accounts) in
+    /// [`HostResponse::messages`]. `password` is resolved by the client
+    /// (inline flag or stdin) and `None` requests a random throwaway.
+    MatrixCreateUser {
+        name: String,
+        #[serde(default)]
+        password: Option<String>,
+    },
+    /// Provision (or re-provision) the hive system admin matrix account.
+    /// Daemon-side equivalent of `hivectl matrix sync-admin`.
+    MatrixSyncAdmin,
+    /// Promote a matrix user to homeserver admin via the admin API.
+    /// Uses the daemon's system admin token; `server_name` is discovered
+    /// from the running homeserver.
+    MatrixPromoteUser { name: String },
+    /// Reset a matrix user's password via the admin API and persist the
+    /// new password to the matrix creds dir so a later token mint can
+    /// re-login. Returns the outcome in [`HostResponse::messages`].
+    MatrixResetPassword { name: String },
+    /// Invite a matrix user to the hive Space (default) or a specific
+    /// `room`. Uses the daemon's admin token; idempotent
+    /// (already-member / already-invited is a no-op).
+    MatrixInvite {
+        user: String,
+        #[serde(default)]
+        room: Option<String>,
+    },
 }
 
 /// Selects which container classes a hive-wide [`HostRequest::Stop`] /
@@ -189,6 +220,13 @@ pub struct HostResponse {
     /// been evicted from the queue's history tail.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub dags: Option<Vec<jobs::DagView>>,
+    /// Free-form operator-facing output lines the client prints verbatim
+    /// (one per line). Carries results a request produced daemon-side that
+    /// have no structured home — e.g. a freshly-minted matrix token, a
+    /// reset password, or an invited room id from the `Matrix*` requests.
+    /// Empty for requests that produce no such output.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub messages: Vec<String>,
 }
 
 impl HostResponse {
@@ -267,4 +305,15 @@ impl HostResponse {
             ..Self::default()
         }
     }
+
+    /// A success carrying operator-facing output lines the client prints
+    /// verbatim — the result shape for the `Matrix*` provisioning requests.
+    #[must_use]
+    pub fn messages(messages: Vec<String>) -> Self {
+        Self {
+            ok: true,
+            messages,
+            ..Self::default()
+        }
+    }
 }