swarm UI: delete linked accounts

Each row of an agent's linked accounts, except its own `main` matrix
account, gets a delete action. swarm-controller serves DELETE beside each
PUT (matrix-accounts/{account}, forge-accounts/{label}, github-account),
answers 404 for an account the store does not hold, refuses `main`, and
removes every version through `delete_all_versions`.

The matrix confirmation has a revoke checkbox, off by default: the
controller logs the stored token out at its homeserver first, and keeps
the account when that fails or no homeserver is stored.

The controller's policy gains `delete` on each agent's
`metadata/.../matrix/+`, `forge/+` and `github-token`, pinned in
bao-grants.nix.

Refs #4855

swarm-controller/src/main.rs

@@ -2977,9 +2977,18 @@ fn build_app(state: AppState) -> axum::Router {
         .routes(routes!(get_agents))
         .routes(routes!(get_agents_status))
         .routes(routes!(set_agent_state))
-        .routes(routes!(matrix_account::put_matrix_account))
-        .routes(routes!(forge_account::put_forge_account))
-        .routes(routes!(github_account::put_github_account))
+        .routes(routes!(
+            matrix_account::put_matrix_account,
+            linked_accounts::delete_matrix_account
+        ))
+        .routes(routes!(
+            forge_account::put_forge_account,
+            linked_accounts::delete_forge_account
+        ))
+        .routes(routes!(
+            github_account::put_github_account,
+            linked_accounts::delete_github_account
+        ))
         .routes(routes!(linked_accounts::get_linked_accounts))
         .routes(routes!(get_hive_wanted))
         .routes(routes!(term_stream::stream_agent_term))