take the agent-create and forge-token responses from swarm-controller-api

swarmctl decoded POST /api/agents and POST /api/agents/{name}/forge-token
into hand-written copies of the controller's private response structs.
Both now live in swarm-controller-api, so a field renamed on one side is a
compile error on the other. Wire format and OpenAPI schema are unchanged.

The request side stays mirrored: CreateAgentRequest carries inference
settings and an ArchetypeRef (swarm-queue-client types) and Permission
(hive-sh4re), and the permissions body is a list of Permission. Where
those types live is #5471's decision.

Files:
- swarm-controller-api/src/agents.rs, lib.rs: the two responses, with
  round-trip tests whose literals come from the tests that move here.
- swarm-controller/src/main.rs: imports them; the struct definitions and
  create_agent_warning_tests (now in the api crate) go.
- swarmctl/src/agent.rs: imports them; the mirrors and their decode tests
  go, and the module doc says only the request is mirrored now.
- swarmctl/src/permissions.rs: its doc pointed at agent.rs for why it
  mirrors; that reason no longer covers Permissions, so it gives its own.
- swarmctl/README.md, swarm-controller-api/README.md, CLAUDE.md: which
  bodies are shared and which are mirrored.

Part of #5472

swarm-controller-api/README.md

@@ -16,6 +16,8 @@ controller's `OpenAPI` spec. `swarmctl` leaves it off.
 
 ## What's here
 
-One module per endpoint family: `forge` (`POST /api/forge/users/{name}/admin`)
-and `schedules` (`/api/schedules`). The agent-create, inference and
-permissions bodies are still mirrored by hand in `swarmctl`.
+One module per endpoint family: `agents` (the responses of `POST /api/agents`
+and `POST /api/agents/{name}/forge-token`), `forge`
+(`POST /api/forge/users/{name}/admin`) and `schedules` (`/api/schedules`).
+The agent-create request, inference and permissions bodies are still mirrored
+by hand in `swarmctl`.