hive-c0re: stop minting agent forge tokens

Delete ensure_user_for and mint_and_persist_agent_token, the user step
of sync_agent (the per-rebuild re-mint, #4644) and of
forge_after_first_spawn, and the hive-priv WriteAgentForgeToken request
that wrote the token into the agent's state dir. hivectl forge
create-user now refuses an agent and points at swarmctl agent
mint-forge-token. mint_token, ensure_user_exists and TOKEN_SCOPES stay:
provision_user_token and the core bootstrap still call them.

Refs #3782

hivectl/src/forge.rs

@@ -1,5 +1,5 @@
 //! `hivectl forge create-user <name>` — provision a Forgejo account via the
-//! daemon (which owns the forge admin token + account-token persistence);
+//! daemon (which owns the forge admin token);
 //! hivectl just resolves the password client-side and relays the request.
 
 use std::io::{self, Write};