refactor(#2352): route hivectl forge create-user through a daemon wire command

hive-host-sock/src/lib.rs

@@ -147,6 +147,17 @@ pub enum HostRequest {
         #[serde(default)]
         room: Option<String>,
     },
+    /// Create or refresh a forge account + API token for `name`. Daemon-side
+    /// equivalent of `hivectl forge create-user`: for an existing agent it
+    /// provisions the account and persists the token to `<notes>/forge-token`;
+    /// for a non-agent (operator/human) it mints a user and returns the token
+    /// in [`HostResponse::messages`]. `password` is resolved client-side
+    /// (inline flag or stdin) and only meaningful for non-agent accounts.
+    ForgeCreateUser {
+        name: String,
+        #[serde(default)]
+        password: Option<String>,
+    },
 }
 
 /// Selects which container classes a hive-wide [`HostRequest::Stop`] /