push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

Cargo.lock

@@ -4807,6 +4807,25 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "swarm-ci-metrics"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "forgejo-api",
+ "hive-log",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "swarm-queue-client",
+ "swarm-secret-client",
+ "tempfile",
+ "time",
+ "tokio",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "swarm-claude-login"
 version = "0.1.0"