swarm UI: an agent that needs a Claude login shows it on its card

The agent's turn-state header ($SWARM.agent-state.<agent>) gains
`needs_login`, set by hive-agent from its own LoginState, so the flag
reaches the swarm without hive-c0re (mara on #5268: "id prefer the agent
container sending the info it needs login without hive").

- swarm-queue-client: `agent_login::Login`, the shared wire type, beside
  `agent_inference::Effective`. `needs_login: Option<bool>` with
  `#[serde(default)]`: a header from an older agent decodes as `None`
  (unknown), never as "needs login" or "logged in".
- hive-agent: the header publisher reads the shared LoginState cell.
  Every writer of that cell emits a status on the bus afterwards, so a
  login change goes out on the next rebuild, not the 60 s refresh.
- swarm-controller: `agent_login::Reported` follows every agent's header
  and keeps the latest flag; `GET /api/agents/status` merges it into each
  row as `needs_login` (null when unknown).
- swarm-ui: AgentCard shows a warning-tone "login needed" badge when the
  row's `needs_login` is true.

Refs #5268

frontend/packages/swarm-ui/test/agent-types.test.mjs

@@ -0,0 +1,19 @@
+// The roster's "login needed" badge rule. Run by `npm test`, which Node runs
+// with its built-in test runner and type stripping, so the `.ts` module is
+// imported as it is.
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { showsLoginNeeded } from "../src/agent/AgentTypes.ts";
+
+test("an agent that says it needs a login gets the badge", () => {
+  assert.equal(showsLoginNeeded({ needs_login: true }), true);
+});
+
+test("an agent that is logged in gets none", () => {
+  assert.equal(showsLoginNeeded({ needs_login: false }), false);
+});
+
+test("an agent that has not said gets none", () => {
+  assert.equal(showsLoginNeeded({ needs_login: null }), false);
+  assert.equal(showsLoginNeeded({}), false);
+});